Assessing Corporate Cybersecurityintermediate
How should CodeForge communicate with its client and a data protection authority while compliance gaps are still being assessed?
Answer
CodeForge should coordinate communications through appropriate responsible roles, use verified evidence, state what is known and what remains unresolved, and avoid unsupported assurances. It should respond within applicable deadlines, explain relevant remediation actions where appropriate, and keep records of communications and decisions. The scenario supports accurate, coordinated communication but does not specify legal response wording or additional deadlines beyond the client's 48-hour request.
Explanation
### What a good answer covers
- Use verified records and clearly separate confirmed facts from unresolved questions.
- Coordinate technical, compliance, cybersecurity, and legal input so that communications are accurate and consistent.
- Explain relevant actions and ownership without claiming that unresolved issues have been fixed.
- Track deadlines, decisions, and communications for follow-up.
### The concept
External communication is part of governance because clients and authorities need reliable information, and the organization must be able to support what it says. The scenario includes a client request with a 48-hour deadline and a preliminary authority inquiry. It does not provide enough detail to invent specific legal advice or a particular response template.
### Terms
- **Preliminary inquiry**: An initial request for information that does not, by itself, establish a final finding.
### Remember
Communicate promptly, coordinate internally, and make claims only when evidence supports them.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free