Frameworks

Question 1

What does NIST stand for and what is the organization’s Focus and Scope?

Answer 1

NIST (National Institute of Standards and Technology) - Detailed cybersecurity controls and standards.

Focus: Primarily cybersecurity and information security risk management.
Scope: Provides detailed technical standards and guidelines for securing information systems, including controls, privacy, and risk management.

Question 2

What does COBIT stand for and what is the organization’s Focus and Scope?

Answer 2

COBIT (Control Objectives for Information and Related Technologies) - IT governance and management framework aligning IT with business.

Focus: IT governance and management.
Scope: Provides a comprehensive framework for managing and governing enterprise IT, aligning IT goals with business objectives.

Question 3

What does COSO stand for and what is the organization’s Focus and Scope?

Answer 3

COSO (Committee of Sponsoring Organizations) - Enterprise-wide internal control and risk management framework, including compliance and operational objectives.

Focus: Enterprise risk management, internal controls, and fraud deterrence.
Scope: Broader than IT; focuses on overall internal control systems and risk management across the entire organization, including operations, reporting, and compliance.

Question 4

What does PCI DSS stand for and what is the organization’s Focus and Scope?

Answer 4

PCI DSS (Payment Card Industry Data Security Standard) - Standards for protecting payment card data

Focus: Protect payment card data during processing, storage, and transmission.
Scope: Applies to all entities handling cardholder data, including merchants, banks, and processors.

Question 5

What does HIPAA stand for and what is the organization’s Focus and Scope?

Answer 5

HIPAA (Health Insurance Portability and Accountability Act) - Security and privacy rules for healthcare data

Focus: Protect personal data privacy and ensure lawful, fair processing.
Scope: Applies to any organization processing personal data of EU residents, regardless of location.

Question 6

What does GDPR stand for and what is the organization’s Focus and Scope?

Answer 6

GDPR (General Data Protection Regulation) - EU data privacy and protection regulations

Focus: Protect privacy and security of protected health information (PHI).
Scope: Applies to covered entities and business associates handling PHI in healthcare.

Question 7

What does CIS stand for and what is the organization’s Focus and Scope?

Answer 7

Center for Internet Security (CIS) Controls (Version 8) - Critical security controls for cybersecurity best practices

Focus: Provide prioritized best practices and safeguards to strengthen an organization’s cybersecurity defenses.
Scope: Applicable to organizations of all sizes, tailored through Implementation Groups (IG1, IG2, IG3) based on cybersecurity maturity and risk profile.

Question 8

What are the three overarching categories that structure COBIT 2019?

Answer 8

Governance system principles guide how to govern IT effectively within an organization. They focus on designing and running a governance system that delivers value, is holistic, dynamic, tailored, and clearly separates governance from management.

Governance framework principles guide how the COBIT framework itself is structured and maintained. They ensure the framework is conceptually sound, flexible, and aligned with other standards so it can be widely adopted and adapted.

Domains in COBIT organize the specific governance and management objectives that put these principles into practice. The governance domain (Evaluate, Direct, and Monitor - EDM) focuses on oversight by the board, while the management domains (Align, Plan, and Organize; Build, Acquire, and Implement; Deliver, Service, and Support; Monitor, Evaluate, and Assess) cover the operational activities that support governance.

Question 9

What are the six main frameworks tested on the ISC exam and what are they for?

Answer 9

COSO INTEGRATED FRAMEWORK: 5 General best practices for designing, implementing, & operating controls that support reporting, operational, and compliance objectives.

COSO ERM (AND CLOUD COMPUTING 8 items): List of 5 topics that provide a roadmap for companies to manage risk.

CIS: 18 Specific controls that support cybersecurity objectives.

COBIT: (7 Guidelines and 1 Governance Domain / 4 Management Domains) Comprehensive set of best practices and guidelines that help organizations govern and manage their IT in a way that aligns with business goals, ensures effective risk management, and maintains strong governance oversight.

NIST CSF: 6 General best-practice activities/functions that organizations should perform to manage cybersecurity and cyber risk effectively
- Govern (set strategy and policies)
- Identify (understand assets and risks)
- Protect (implement safeguards)
- Detect (discover cybersecurity events)
- Respond (contain and mitigate incidents)
- Recover (restore normal operations)

NIST SPF (800-53): 8 functions functions that guide organizations in managing privacy risks related to data processing. (Identify-P, Govern-P, Control-P, Communicate-P, Protect-P, Detect, Respond, Recover)