Explain why frameworks, standards, laws, and assurance reports should not be treated as interchangeable when an organization plans its cybersecurity compliance.
Answer
A framework organizes security outcomes and practices. A standard specifies security outcomes or requirements. A law or regulation creates legal duties for organizations within its scope. An assurance report, such as SOC 2, provides an examination of controls against stated criteria. Organizations should identify applicable obligations, map them to controls, and use evidence to assess compliance.
Explanation
### What a good answer covers
- A framework gives an organized structure for managing security outcomes and risk.
- A standard sets expectations or requirements that can be assessed.
- A law or regulation imposes duties within its scope, while a contract can create additional obligations.
- An assurance report examines controls against criteria; it is not itself a general law.
- Organizations must map the requirements that apply to their own operations and gather evidence of implementation.
### Terms
- **Framework**: An organized structure for security outcomes and practices.
- **Standard**: A set of stated security requirements or outcomes.
- **Regulation**: A binding rule imposed by a governing authority.
- **Assurance report**: A report describing an examination of controls against defined criteria.
- **SOC 2**: System and Organization Controls 2, an assurance examination framework for service organizations.
### Remember
Identify the source and purpose of each requirement before treating it as evidence of compliance.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free