week 7 compliance

What are the three sources of compliance requirements?

Laws/regulations, industry standards and internal organisational policies.

What is the Privacy Act 1988?

Australian law regulating how covered organisations handle personal information.

Which businesses are generally covered by the Privacy Act?

Australian businesses with annual turnover above $3 million, plus certain exceptions regardless of turnover.

What is the NDB Scheme?

The Notifiable Data Breaches Scheme requires notification of eligible data breaches likely to cause serious harm.

What must an organisation do after suspecting an eligible data breach?

Assess it within 30 days and, if eligible, notify the OAIC and affected individuals as soon as practicable.

What does OAIC stand for?

Office of the Australian Information Commissioner.

What is the maximum serious Privacy Act penalty?

The greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover.

What does the Cyber Security Act require for ransomware payments?

Covered organisations must report ransomware or cyber-extortion payments within 72 hours.

Does the Cyber Security Act make paying ransomware automatically illegal?

No. It imposes reporting obligations; it does not create a general ban on payment.

What does SOCI stand for?

Security of Critical Infrastructure.

What does the SOCI Act protect?

Critical infrastructure such as energy, communications, finance, healthcare, water, transport and data services.

What are the SOCI cyber-incident reporting deadlines?

12 hours for significant-impact incidents; 72 hours for other relevant incidents.

What is a CIRMP?

A Critical Infrastructure Risk Management Program covering cyber, personnel, supply-chain and physical risks.

What does APRA stand for?

Australian Prudential Regulation Authority.

What does CPS 234 cover?

Information-security capability, asset classification, incident response and independent assurance.

What does CPS 230 cover?

Operational resilience, business continuity and management of critical third-party providers.

What does ACSC stand for?

Australian Cyber Security Centre.

What is the Essential Eight?

Eight ASD/ACSC mitigation strategies forming a baseline for reducing common cyber risks.

Name the Essential Eight.

Application control; patch applications; configure macros; application hardening; restrict admin privileges; patch operating systems; MFA; regular backups.

What are the Essential Eight maturity levels?

Levels 0–3, where higher levels provide stronger protection against more capable attackers.

What is GDPR and who can it apply to?

EU data-protection law that can apply to organisations handling the personal data of people in the EU/EEA.

What is the difference between a GDPR controller and processor?

The controller decides why and how data is processed; the processor handles it for the controller.

What does HIPAA protect?

Protected Health Information handled by covered US healthcare organisations and associates.

What does GLBA regulate?

US financial institutions through privacy-notice and information-safeguard requirements.

What does SOX require?

US public-company executives must ensure the accuracy of financial reporting and internal controls.

What is the documentation hierarchy?

Strategy → Policy → Standard → Procedure → Guideline.

What is the difference between a policy and procedure?

A policy states high-level rules or why; a procedure explains the steps or how.

What is fiduciary duty?

A duty to act honestly and in the best interests of another person or organisation.

What is the difference between due care and due diligence?

Due care means taking reasonable protective action; due diligence means continually investigating and verifying that protection.

What four internal controls help prevent fraud?

Separation of duties, job rotation, mandatory vacations and Acceptable Use Policies.

What is an Acceptable Use Policy (AUP)?

Rules explaining how employees may and may not use organisational systems and assets.

How does separation of duties reduce fraud?

It divides a critical process between people so one person cannot complete and conceal fraud alone.

How do job rotation and mandatory vacations help detect fraud?

Another employee performs the role, making hidden manipulation or irregularities easier to uncover.

What is PCI DSS?

An industry standard for organisations that store, process or transmit payment-card data.

What are the three PCI DSS process steps?

Assess → Remediate → Report.

What does a QSA do?

A Qualified Security Assessor evaluates an organisation’s PCI DSS compliance.

What is COBIT mainly used for?

Governance and management of enterprise information and technology.

What is COBIT’s key distinction?

Governance evaluates and directs; management plans, builds, runs and monitors.

What is ISO 27001?

The requirements standard for establishing an Information Security Management System.

What is ISO 27002?

Guidance and recommended information-security controls.

What is ISO 31000?

Guidelines for managing organisational risk.

What is NIST SP 800-30?

A guide for conducting risk assessments.

Scenario: a serious privacy breach may harm customers—what applies?

Assess under the NDB Scheme and notify the OAIC and affected people if it is eligible.

Scenario: a critical infrastructure incident significantly disrupts availability—when report?

Within 12 hours under SOCI.

Scenario: one employee creates and approves payments—what control is missing?

Separation of duties.

Scenario: an organisation needs an ISMS certification standard—which one?

ISO 27001.