ISC - 1

Regulations, Standards, and Frameworks

What is the purpose of the NIST Cybersecurity Framework (CSF)?

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is a voluntary framework that helps organizations identify, manage, and reduce cybersecurity risks.

💡 Think of it as a roadmap for protecting an organization's information systems.

What are the three components of the NIST CSF?

• Core: What cybersecurity activities should we perform?

• Tiers: How sophisticated are our cybersecurity practices? → used to gauge performance & communicate about how to allocate resources based on current and target Tiers.

• Organizational profiles: Where are we now, and where do we want to be?

What are the 6 functions of the NIST Cybersecurity Framework Core? (GIPDRR)

Function	Purpose	Example
Govern	Establish cybersecurity strategy and oversight	Board approves security policies
Identify	Understand assets and risks	Inventory company laptops
Protect	Prevent or limit security incidents	Require multifactor authentication
Detect	Discover cybersecurity incidents	Identify suspicious logins
Respond	Take action during an incident	Isolate an infected computer
Recover	Restore normal operations	Restore data from backups

💡 These functions are performed concurrently, not necessarily sequentially.

What are the 4 NIST CSF and PF tiers?

Tier	Name	Meaning
1	Partial	Informal, reactive risk management
2	Risk-informed	Risk awareness exists, but practices aren't consistently organization-wide
3	Repeatable	Formal, consistently implemented practices
4	Adaptive	Continuously improves and adapts to changing risks

💡 Higher tier = more sophisticated cybersecurity risk management.

What is the purpose of a NIST organizational profile?

To compare an organization's current cybersecurity practices with its target practices, identify gaps, and create an improvement plan.

Example: A company currently uses passwords but wants multifactor authentication for all employees. Its profile helps identify that gap.

What are the 5 steps for using NIST CSF Organizational Profiles for continuous improvement?

1. Scope the Profile – Define what part of the organization, system, or process will be assessed.

2. Gather Information – Collect data about current cybersecurity practices and requirements.

3. Create the Profile – Document the current and/or target cybersecurity posture.

4. Analyze Gaps & Develop an Action Plan – Compare the current profile to the target profile and identify improvements.

5. Implement & Update – Execute the action plan and continuously update the profile.

How does the NIST Privacy Framework differ from the Cybersecurity Framework?

• Cybersecurity Framework: Manages cybersecurity risks.

• Privacy Framework: Manages risks to individuals arising from data processing.

Example: Preventing hackers from stealing customer data is a cybersecurity concern. Deciding how much personal information to collect is a privacy concern.

What are the 8 NIST Privacy Framework functions listed in Becker? (GIPDRRCC)

Function	Purpose	Example
Govern	Establish privacy strategy and oversight	Board approves privacy policies
Identify	Understand personal data and privacy risks	Inventory customer data collected
Protect	Safeguard personal data	Encrypt customer information
Detect	Discover privacy incidents	Detect unauthorized access to personal data
Respond	Take action during a privacy incident	Investigate and contain a data breach
Recover	Restore operations after an incident	Restore affected systems and data
Control	Manage how personal data is processed	Allow customers to delete their data
Communicate	Inform individuals about data practices	Publish a privacy notice

💡 Remember: Compared with the six NIST Cybersecurity Framework functions (GIPDRR), Becker's privacy list adds:

• Control: Give individuals control over their personal data.

• Communicate: Be transparent about how personal data is used.

ISC exam tip: Control = managing data. Communicate = explaining data practices.

Note: This follows Becker's eight-function comparison. The official NIST Privacy Framework 1.0 has five functions: Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P.

What is NIST SP 800-53?

A collection of security and privacy controls organizations can use to manage information-system risks.

It is particularly important for federal information security systems.

What are the 3 NIST SP 800-53 control implementation approaches?

1. Common (inheritable): A shared control protecting multiple systems.

2. System-specific: A control protecting one particular system.

3. Hybrid: A combination of shared and system-specific elements.

Example: A building-wide physical security system is a common control; an application-specific login restriction is system-specific.

What is the purpose of data privacy laws?

To protect individuals' personal information by regulating how organizations collect, process, maintain, and disclose it.

💡 Privacy laws also help establish consumer trust.

What is a data breach?

The exposure of confidential information to unauthorized individuals.

Breaches can be:

• Intentional: A hacker steals customer records.

• Unintentional: An employee emails confidential records to the wrong recipient.

What are the 4 major types of financial costs of a data breach?

1. Detection and escalation

2. Notification

3. Post-breach response

4. Lost business and revenue

Example: After a breach, a company pays investigators, notifies customers, provides identity-monitoring services, and loses customers.

What does HIPAA protect?

The Health Insurance Portability and Accountability Act (HIPAA) establishes standards for protecting health information in the healthcare industry.

Its two important rules are:

• Privacy Rule: Governs the use and disclosure of protected health information.

• Security Rule: Establishes safeguards for electronic protected health information.

What is the GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation governing personal data privacy.

Personal data may be processed when a lawful basis exists, such as valid consent or compliance with a legal obligation.

💡 GDPR violations can result in substantial fines.

What is the difference between HIPAA and GDPR?

• HIPAA: U.S. healthcare information.

• GDPR: Personal data protected under European Union law.

Example: A U.S. hospital handling patient records may be subject to HIPAA; a company processing personal data of individuals in the EU may be subject to GDPR.

What is PCI DSS, and what data does it protect?

The Payment Card Industry Data Security Standard (PCI DSS) establishes security requirements for organizations handling payment card information.

PCI DSS protects account data, which includes:

1. Cardholder Data (CHD)

• Primary Account Number (PAN)

• Cardholder name

• Expiration date

• Service code

2. Sensitive Authentication Data (SAD)

• Full track data (magnetic stripe/chip data)

• Card Verification Code (CVV/CVC/CID)

• PIN / PIN block

Not protected under PCI DSS account data: transaction amount, purchase details, merchant information.

What are the 6 PCI DSS security goals?

1. Build and maintain secure networks and systems.

2. Protect account data.

3. Maintain a vulnerability management program.

4. Implement strong access controls.

5. Monitor and test networks regularly.

6. Maintain an information security policy.

💡 PCI DSS focuses on payment security, not general medical or personal-data privacy.

What are CIS Controls?

The Center for Internet Security (CIS) Controls are recommended cybersecurity best practices that organizations can implement to strengthen their defenses.

💡 NIST provides broad risk-management frameworks;

💡CIS Controls emphasize practical security actions.

What are the 3 design principles of CIS Controls?

• Context: Provide practical explanations and examples.

• Coexistence: Align with other frameworks, such as NIST CSF.

• Consistency: Minimize disruption when controls are updated.

What are the 3 CIS Implementation Groups (IGs)?

Group	Intended organization
IG1	Smaller organizations with limited cybersecurity resources
IG2	Organizations with dedicated IT staff, varied risks, and sensitive data
IG3	Organizations with specialized cybersecurity experts

IG2 includes IG1 safeguards; IG3 includes IG1 and IG2 safeguards.

What are CIS Safeguards?

Specific recommended actions used to accomplish the objectives of CIS Controls.

Example: If the control is managing software assets, a safeguard might involve maintaining an inventory of authorized applications.

What is CIS Control 1: Inventory and Control of Enterprise Assets?

Identify and manage the organization's IT assets, including physical and cloud-based assets.

Example: Maintain a list of all company laptops, servers, and cloud resources.

What is CIS Control 2: Inventory and Control of Software Assets?

Track and manage software so that only authorized applications are installed and used.

Example: IT blocks employees from installing unapproved applications.

💡 Control 1 = hardware/assets; Control 2 = software.

What is CIS Control 3: Data Protection?

Protect information throughout its entire life cycle, from identification and classification through disposal.

Example: Encrypt sensitive files and securely delete them when no longer needed.

What is CIS Control 4: Secure Configuration of Enterprise Assets and Software?

Establish and maintain secure baseline configurations.

Example: Disable unnecessary services and change insecure default settings on new computers.

What is the difference between CIS Control 5 and Control 6?

• Control 5 — Account Management: Manage user accounts and credentials.

• Control 6 — Access Control Management: Determine what resources and permissions those accounts should have.

Example: Creating an employee's account is Control 5. Restricting that account to read-only financial reports is Control 6.

What is CIS Control 7: Continuous Vulnerability Management?

Continuously identify, track, and remediate weaknesses in IT systems.

Example: Regularly scan company servers for security vulnerabilities and fix discovered weaknesses.

What is CIS Control 8: Audit Log Management?

Collect, manage, and analyze system logs to help identify security incidents and support investigations and recovery.

Example: Reviewing login records reveals repeated unauthorized access attempts.

What is CIS Control 9: Email and Web Browser Protections?

Protect employees from cyber threats originating through email and internet browsing.

Example: Block malicious email attachments and dangerous websites.

What is CIS Control 10: Malware Defenses?

Prevent malicious software from being installed or spreading through an organization's systems.

Example: Endpoint protection software detects and quarantines malware.

What is CIS Control 11: Data Recovery?

Establish backup, restoration, and testing procedures to recover information after an incident.

Example: Restore company files from a tested backup following a ransomware attack.

What is the difference between CIS Controls 12 and 13?

• Control 12 — Network Infrastructure Management: Securely configure and manage network infrastructure.

• Control 13 — Network Monitoring and Defense: Monitor network activity and defend against threats.

Example: Configuring a router securely is Control 12; monitoring network traffic for an attack is Control 13.

What is CIS Control 14: Security Awareness and Skills Training?

Train employees to recognize and reduce cybersecurity risks.

Example: Conduct phishing-awareness training and simulated phishing exercises.

What is CIS Control 15: Service Provider Management?

Evaluate and manage cybersecurity risks involving third-party vendors that handle sensitive data or provide IT services.

Example: Assess a payroll provider's security practices before sharing employee information.

What is CIS Control 16: Application Software Security?

Manage security throughout the life cycle of acquired, hosted, or internally developed software.

Example: Test an application for vulnerabilities before releasing it to customers.

What is CIS Control 17: Incident Response Management?

Establish procedures to prepare for, detect, and respond to cybersecurity incidents.

Example: A company follows a predefined response plan after discovering unauthorized network access.

What is CIS Control 18: Penetration Testing?

Simulate actual cyberattacks to discover weaknesses that attackers could exploit.

Example: A company hires ethical hackers to attempt to breach its systems.

💡 Vulnerability management (Control 7) identifies and remediates weaknesses continuously; penetration testing (Control 18) actively simulates attacks.

What is COBIT, and who developed it?

Control Objectives for Information and Related Technologies (COBIT) is an IT governance and management framework developed by the Information Systems Audit and Control Association (ISACA).

It helps organizations align technology management with business objectives.

How does COBIT differ from NIST and CIS?

• COBIT: Governance and management of enterprise IT.

• NIST CSF: Cybersecurity risk management.

• CIS Controls: Practical cybersecurity safeguards.

Example: COBIT helps executives establish accountability for IT decisions; CIS helps IT staff implement specific security measures.

What are the 6 COBIT 2019 governance-system principles?

Think: “How should the governance system be designed and operate?”

1. Provide stakeholder value.

2. Use a holistic approach.

3. Maintain a dynamic governance system.

4. Keep governance distinct from management.

5. Tailor governance to enterprise needs.

6. Apply governance end-to-end.

What are the 3 COBIT governance-framework principles?

how COBIT itself is built

Principle	What it means	Real-life example
1. Based on a conceptual model	COBIT has an organized structure showing how IT governance works.	The company uses COBIT's framework to understand how IT policies, processes, and responsibilities fit together.
2. Open and flexible	COBIT can adapt as technology and business needs change.	The company adopts AI tools and updates its IT governance practices accordingly.
3. Aligned with major standards	COBIT works alongside other recognized frameworks.	The company uses COBIT for IT governance and NIST for cybersecurity risk management.

CPA exam tip: COBIT doesn't replace NIST or other standards. It provides an overarching governance framework that can work with them.

What is the difference between governance and management in COBIT?

• Governance: Evaluates stakeholder needs, sets direction, and monitors results.

• Management: Plans, builds, operates, and monitors activities to achieve that direction.

Example: The board decides the company's IT risk tolerance (governance). IT management implements security controls to meet that tolerance (management).

What are the 5 COBIT 2019 core model domains?

Domain	Acronym	Function
Evaluate, Direct, and Monitor	EDM	Governance
Align, Plan, and Organize	APO	Management
Build, Acquire, and Implement	BAI	Management
Deliver, Service, and Support	DSS	Management
Monitor, Evaluate, and Assess	MEA	Management

💡 EDM is the only governance domain. The other four are management domains.

What are the 7 components of a COBIT governance system?

Think: “What pieces make up the governance system?”

1. Processes

2. Organizational structures

3. Principles, policies, and frameworks

4. Information

5. Culture, ethics, and behavior

6. People, skills, and competencies

7. Services, infrastructure, and applications

These components work together to achieve governance and management objectives.

What replaced the EU–U.S. Safe Harbor Framework for transferring personal data?

Privacy Shield (2016)

• Safe Harbor (2000): Allowed companies to transfer personal data from the EU to the U.S.

• Privacy Shield (2016): Replaced Safe Harbor after concerns that U.S. surveillance laws inadequately protected EU citizens' privacy.

• EU–U.S. Data Privacy Framework (2023): Replaced Privacy Shield after it was invalidated in 2020.

💡 Remember: Safe Harbor → Privacy Shield → Data Privacy Framework.

Why? The EU requires adequate protection of personal data transferred outside the EU. These frameworks were designed to facilitate compliant transfers between the EU and U.S.

ISC exam tip: If asked what immediately replaced Safe Harbor, answer Privacy Shield, even though it is no longer the current framework.

What do CSF and PF Tiers evaluate?

Their tier levels are the same, but they evaluate slightly different things.

CSF	PF
Cybersecurity risk management	Privacy risk management
Risk management process	Risk management process
Integrated risk management program	Integrated privacy risk management program
Ecosystem relationships	Ecosystem relationships
—	Workforce (additional subdivision)

What does the HIPAA Security Rule require for electronic protected health information (ePHI)?

Covered entities must ensure the CIA Triad: Confidentiality, Integrity, and Availability.

Principle	Meaning	Example
Confidentiality	Only authorized people can access information	Passwords and access controls
Integrity	Information remains accurate and isn't improperly altered	Audit logs and change controls
Availability	Information is accessible when needed	Data backups and disaster recovery

💡 Remember:

• C = Keep it secret

• I = Keep it accurate

• A = Keep it accessible

Why? Healthcare providers must protect patient information from unauthorized access, improper changes, and system outages.

In COBIT 2019, what are the four "Role of IT" categories, and how do they differ?

Role of IT	Important for Operations?	Important for Innovation?	Example
Support	❌ No	❌ No	Basic HR or admin system
Factory	✅ Yes	❌ No	Manufacturing or order-processing system
Turnaround	❌ No	✅ Yes	New AI, analytics, or innovation platform
Strategic	✅ Yes	✅ Yes	E-commerce platform central to business strategy

What are the 11 COBIT 2019 Design Factors?

Design factors are characteristics of an organization that influence how IT governance should be designed.

1. Enterprise Strategy – overall business strategy (e.g. growth, innovation, cost leadership)

2. Enterprise Goals – what the business wants to achieve

3. Risk Profile – types and levels of risk the organization faces

4. IT-Related Issues – current problems or pain points in IT

5. Threat Landscape – external cyber and technology threats(maybe classified as high or low)

6. Compliance Requirements – laws, regulations, and standards to follow

7. Role of IT – how important IT is to the business (support, factory, turnaround, or strategic

8. Sourcing Model for IT – how IT services are obtained (in-house, outsourced, cloud, etc.)

9. IT Implementation Methods – how IT projects are delivered

10. Enterprise Size – size of the organization

11. Industry – the industry sector it operates in

Design Factors = "What is this organization like?"

Focus Areas = "What needs extra attention?"

Design Factors = Customize COBIT

Focus Areas = Emphasize COBIT

Under HIPAA, when can PHI be used or disclosed WITHOUT patient authorization?

PHI may be used/disclosed without authorization for:

✅ Treatment, Payment, and Health Care Operations (TPO)

• Treating patients

• Billing and collections

• Quality improvement and administrative operations

✅ Research using a limited (redacted) data set

✅ Public interest and benefit activities authorized by law

• Public health reporting

• Law enforcement purposes

• Certain government functions

❌ Marketing generally requires patient authorization.

What is the difference between COBIT 2019 Governance System Principles and Governance Framework Principles?

Governance System Principles = WHAT the enterprise's governance system should do

• Provide stakeholder value

• Holistic approach

• Dynamic governance system

• Governance distinct from management

• Tailored to enterprise needs

• End-to-end governance system

Think: "How governance operates in the organization."

---

Governance Framework Principles = HOW COBIT is designed

• Based on a conceptual model

• Open and flexible

• Aligned to major standards

Think: "How the COBIT framework itself is built."