Examius

🇬🇧 CISMP (Certificate in Information Security Management Principles) · subject

CISMP (Certificate in Information Security Management Principles) Information Security Frameworks, Law and Compliance Syllabus

The Information Security Frameworks, Law and Compliance syllabus for CISMP (Certificate in Information Security Management Principles) in full: 3 chapters, 11 topics and 20 sub-topics, every one listed below, plus 50 Information Security Frameworks, Law and Compliance flashcards with answers.

3Chapters
11Topics
20Sub-topics
50Flashcards

Information Security Frameworks, Law and Compliance syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Organisation and Responsibilities

     3 topics
    • Internal organisation of security
      • Segregation of duties
      • Contact with authorities and special interest groups
    • Third-party and supplier security
      • Supply chain risk
      • Contractual security requirements
    • Security in projects and change

  2. UK and International Law

     4 topics
    • UK GDPR and Data Protection Act 2018
      • Data protection principles
      • Rights of data subjects
      • Role of the ICO
    • Computer Misuse Act 1990
      • Unauthorised access offences
      • Impairing computer operation
    • Intellectual property and copyright
      • Software licensing
      • Copyright, Designs and Patents Act
    • Other relevant legislation
      • Regulation of Investigatory Powers / Investigatory Powers Act
      • Freedom of Information Act
      • Network and Information Systems (NIS) Regulations

  3. Standards, Procedures and Compliance

     4 topics
    • International and UK standards
      • ISO/IEC 27000 family
      • PCI DSS for payment data
    • Codes of practice and good practice guides
      • NCSC guidance and Cyber Essentials
    • Compliance monitoring and audit
      • Internal versus external audit
      • Demonstrating compliance
    • Records management and retention
      • Retention schedules and legal hold

CISMP (Certificate in Information Security Management Principles) Information Security Frameworks, Law and Compliance flashcards — 50 questions with answers

  1. What is the purpose of defining an 'internal organisation of security' within an ISMS?

    To establish a management framework that initiates and controls the implementation and operation of information security within the organisation - allocating roles, responsibilities and authorities for security.

  2. In information security governance, what is the difference between 'responsibility' and 'accountability'?

    Accountability is the ultimate ownership/answerability for an outcome and cannot be delegated (typically held by senior management/the board). Responsibility is the duty to carry out specific tasks and can be delegated to others.

  3. What does 'segregation (separation) of duties' achieve as an internal organisational control?

    It divides conflicting tasks among different people so no single individual can both perpetrate and conceal an error or fraud, reducing the risk of misuse, fraud and unauthorised modification of assets.

  4. Who is typically accountable at board level for information security in an organisation?

    A senior responsible owner such as a member of the board or executive (e.g. a CISO reporting upward, or a designated director); the board retains overall accountability for risk and security governance.

  5. What is the role of a Senior Information Risk Owner (SIRO) in a UK public-sector context?

    A board-level executive accountable for managing information risk across the organisation, owning the information risk policy, fostering a risk-aware culture and advising the board on information risk.

  6. What is the function of an 'Information Asset Owner' (IAO)?

    A senior individual accountable for a specific information asset - understanding what information is held, how it is used and protected, and ensuring risks to that asset are identified and managed.

  7. Why should security responsibilities be defined and allocated in job descriptions and contracts?

    To ensure individuals know their security duties, create enforceable obligations, support accountability, and demonstrate due diligence/compliance with policy and standards.

  8. What is the value of maintaining 'contact with special interest groups' and authorities as an organisational control?

    It keeps the organisation informed of threats, vulnerabilities, best practice and legal/regulatory changes, and ensures appropriate liaison with authorities (e.g. police, regulators) during incidents.

  9. Why must information security be addressed in 'project management' regardless of the project type?

    So that security risks are identified and treated early ('security by design'), avoiding costly retrofits; security requirements should be integrated into all projects, not just IT/security projects.

  10. What are the main security risks introduced by third-party suppliers accessing organisational information?

    Loss of direct control, increased attack surface, data leakage, weaker supplier security, breach of confidentiality, supply-chain compromise and inadequate incident handling.

  11. What should be agreed before granting a supplier access to organisational information assets?

    The security requirements - documented in contracts/agreements - covering access rights, data handling, confidentiality, applicable controls, audit rights, incident reporting and return/destruction of data.

  12. What is a 'supply chain attack' in information security?

    An attack that compromises an organisation indirectly by targeting a less-secure element in its supplier or product supply chain (e.g. malicious software updates or a compromised vendor).

  13. What contractual clauses help manage third-party/supplier information security risk?

    Confidentiality/NDA clauses, defined security requirements, right-to-audit, incident notification timeframes, sub-contractor (fourth-party) controls, data return/destruction, and liability/indemnity terms.

  14. What is the purpose of a 'right to audit' clause in a supplier contract?

    It gives the organisation the contractual ability to verify (directly or via a third party) that the supplier is meeting agreed security obligations and controls.

  15. Why should information security be considered during 'change management'?

    Uncontrolled changes can introduce vulnerabilities, break controls or cause outages; change management ensures changes are assessed for security impact, tested, approved and reversible (rollback).

  16. What is the difference between 'change management' and 'configuration management'?

    Change management is the controlled process for requesting, assessing, approving and implementing changes. Configuration management maintains an accurate record of assets/configurations (CMDB) and their relationships.

  17. Within the UK, what two main pieces of legislation together govern data protection since 2018?

    The UK GDPR (UK General Data Protection Regulation) and the Data Protection Act 2018 (DPA 2018), which supplements and tailors the UK GDPR.

  18. Define 'personal data' under the UK GDPR.

    Any information relating to an identified or identifiable living natural person (data subject) who can be identified directly or indirectly, e.g. by name, ID number, location data or online identifier.

  19. What are the 'special categories' of personal data under UK GDPR that require extra protection?

    Data revealing racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data on sex life or sexual orientation.

  20. List the seven data protection principles under the UK GDPR (Article 5).

    1) Lawfulness, fairness and transparency; 2) Purpose limitation; 3) Data minimisation; 4) Accuracy; 5) Storage limitation; 6) Integrity and confidentiality (security); 7) Accountability.

Show the other 30 Information Security Frameworks, Law and Compliance flashcards

  1. What does the 'accountability' principle in UK GDPR require of organisations?

    The controller must not only comply with the principles but be able to demonstrate compliance (through policies, records of processing, DPIAs, training and documentation).

  2. Define 'data controller' and 'data processor' under UK GDPR.

    A controller determines the purposes and means of processing personal data. A processor processes personal data on behalf of, and under the instructions of, the controller.

  3. What are the six lawful bases for processing personal data under Article 6 of the UK GDPR?

    Consent, Contract, Legal obligation, Vital interests, Public task, and Legitimate interests.

  4. List the data subject rights granted by the UK GDPR.

    Right to be informed, right of access, right to rectification, right to erasure ('right to be forgotten'), right to restrict processing, right to data portability, right to object, and rights regarding automated decision-making and profiling.

  5. What is the standard time limit for responding to a Data Subject Access Request (DSAR) under UK GDPR?

    One month (one calendar month) from receipt, extendable by a further two months for complex or numerous requests; usually provided free of charge.

  6. Under UK GDPR, within what timeframe must a notifiable personal data breach be reported to the ICO?

    Without undue delay and, where feasible, not later than 72 hours after becoming aware of it (if it poses a risk to individuals' rights and freedoms).

  7. Who is the UK's supervisory authority (regulator) for data protection?

    The Information Commissioner's Office (ICO).

  8. What are the maximum administrative fines under the UK GDPR?

    Up to £17.5 million or 4% of total annual worldwide turnover (whichever is higher) for the most serious infringements; up to £8.75 million or 2% for lesser infringements.

  9. What is a Data Protection Impact Assessment (DPIA) and when is it required?

    A process to identify and minimise data protection risks of a project. Required when processing is likely to result in a high risk to individuals (e.g. large-scale special category data, systematic monitoring, new technologies).

  10. When must an organisation appoint a Data Protection Officer (DPO) under UK GDPR?

    When it is a public authority, or its core activities involve large-scale regular and systematic monitoring of individuals, or large-scale processing of special category/criminal data.

  11. What are the three main offences created by the Computer Misuse Act 1990?

    Section 1: unauthorised access to computer material; Section 2: unauthorised access with intent to commit/facilitate further offences; Section 3: unauthorised acts with intent to impair operation (e.g. malware/DoS).

  12. What additional offence was added to the Computer Misuse Act 1990 covering hacking tools?

    Section 3A: making, supplying or obtaining articles (e.g. tools/programs) for use in committing CMA offences.

  13. What is the key concept that determines whether access is an offence under the Computer Misuse Act 1990?

    Authorisation - the access or act must be 'unauthorised'. Knowingly exceeding or acting without authorisation is the offence; the user's belief about their authority is relevant to intent.

  14. What is the maximum penalty under Section 3 of the Computer Misuse Act 1990 (unauthorised acts impairing operation)?

    Up to 10 years' imprisonment and/or an unlimited fine on indictment (and Section 3ZA covering serious damage can carry life imprisonment).

  15. What is the difference between copyright and a patent in intellectual property law?

    Copyright protects the expression of original works (e.g. software code, documents) automatically with no registration. A patent protects novel inventions/processes and must be applied for and granted.

  16. Which UK Act primarily governs copyright, including software?

    The Copyright, Designs and Patents Act 1988 (CDPA), under which computer programs are protected as literary works.

  17. How long does copyright generally last for literary works (including software) in the UK?

    For literary, dramatic, musical and artistic works: the life of the author plus 70 years. (Software is treated as a literary work.)

  18. What are the four main types of intellectual property protection?

    Copyright, patents, trade marks, and registered/unregistered designs (with trade secrets/confidential information also protected separately).

  19. What is a software licence and why does it matter for compliance?

    A legal agreement granting permission to use software under defined terms; using software outside licence terms (e.g. over-deployment or unlicensed copies) infringes copyright and breaches compliance, risking legal/financial penalties.

  20. What does the Investigatory Powers Act 2016 (the 'Snoopers' Charter') regulate?

    The powers of public authorities to carry out interception, communications data acquisition and equipment interference, and obligations on communication providers to retain communications data.

  21. What does the Regulation of Investigatory Powers Act 2000 (RIPA) cover relevant to organisations?

    It regulates interception of communications and lawful monitoring; organisations monitoring employee communications must have lawful basis, policy and notice (see also Lawful Business Practice Regulations).

  22. What does the Network and Information Systems (NIS) Regulations 2018 require?

    Operators of essential services (OES) and relevant digital service providers (RDSP) to take appropriate security measures and report significant incidents, improving the resilience of critical network and information systems.

  23. What is the Freedom of Information Act 2000, and who does it apply to?

    It gives the public a right of access to recorded information held by UK public authorities; authorities must respond to requests (generally within 20 working days), subject to exemptions.

  24. What is the difference between the FOIA 2000 and the UK GDPR/DPA 2018 regarding access?

    FOIA gives anyone access to recorded information held by public authorities (any subject). UK GDPR/DPA gives individuals access to their own personal data (a Subject Access Request).

  25. Within the ISO/IEC 27000 family, what is the difference between ISO/IEC 27001 and ISO/IEC 27002?

    ISO/IEC 27001 is the certifiable specification for an ISMS (requirements). ISO/IEC 27002 is a code of practice giving guidance on the implementation of information security controls (not certifiable).

  26. What does ISO/IEC 27001 certification demonstrate?

    That an organisation has an independently audited Information Security Management System (ISMS) meeting the standard's requirements, with a risk-based approach to managing information security.

  27. What is the UK Government's Cyber Essentials scheme?

    A government-backed certification scheme defining five basic technical controls (firewalls, secure configuration, user access control, malware protection, security/patch update management) to protect against common cyber attacks; Cyber Essentials Plus adds independent technical verification.

  28. What is the purpose of compliance monitoring and security audit within an ISMS?

    To independently verify that controls are implemented, effective and complied with - providing assurance to management, identifying gaps/non-conformities and driving continual improvement.

  29. What is the difference between an internal audit and an external (independent) audit?

    An internal audit is performed by the organisation's own staff (first/second-party) for self-assurance and improvement. An external audit is performed by an independent third party (e.g. certification body) providing impartial assurance.

  30. What are the key drivers for records management and a records retention schedule?

    Legal/regulatory requirements, business/operational need, and accountability. A retention schedule defines how long records are kept and ensures secure, timely disposal - balancing storage limitation (e.g. UK GDPR) against legal retention obligations.

CISMP (Certificate in Information Security Management Principles) Information Security Frameworks, Law and Compliance FAQ

What is in the CISMP (Certificate in Information Security Management Principles) Information Security Frameworks, Law and Compliance syllabus?

CISMP (Certificate in Information Security Management Principles) Information Security Frameworks, Law and Compliance is split into 3 chapters: Organisation and Responsibilities, UK and International Law and Standards, Procedures and Compliance. Together they contain 11 topics and 20 sub-topics.

How many chapters are in CISMP (Certificate in Information Security Management Principles) Information Security Frameworks, Law and Compliance?

3 chapters, containing 11 topics and 20 sub-topics. The largest chapter is UK and International Law, with 4 topics.

Are there flashcards for CISMP (Certificate in Information Security Management Principles) Information Security Frameworks, Law and Compliance?

Yes — a 50-card Information Security Frameworks, Law and Compliance deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.