5.4 - Compliance, BIA and business continuity
Security+ SY0-701 objective 5.4 covers compliance and keeping the business running through disruption. A merchant that stores and processes credit-card data must comply primarily with PCI DSS, the card-industry data security standard. A business impact analysis (BIA) identifies which business processes are most critical and the maximum time they can be down, feeding metrics like RTO and RPO. A business continuity plan (BCP) documents how the whole organisation keeps critical operations running during a disruption, while a disaster recovery plan focuses on restoring IT. You should also know regulations such as GDPR and HIPAA, compliance reporting, attestation, audits, and the consequences of non-compliance. Expect scenario questions that name a data type, a planning activity or a required standard and ask which compliance obligation, analysis or continuity document applies.
Card data compliance = PCI DSS. Find critical processes + max downtime = BIA. Keep the whole business running in a disruption = BCP (DR plan = restore IT). Health data = HIPAA; EU personal data = GDPR.
Practice questions
1. A retailer storing customer credit-card data must comply with which standard?
- HIPAA (health data)
- PCI DSS (card data) (correct answer)
- COPPA (children's data)
- FERPA (education records)
PCI DSS governs payment-card data handling. HIPAA=health data, GDPR=EU personal data, FERPA=education records. Match the regulation to the data.
2. A likely consequence of failing to comply with a data-protection regulation is:
- Automatic cyber-insurance
- Fines and reputational damage (correct answer)
- Faster incident response
- Reduced audit frequency
Non-compliance can bring regulatory fines, legal sanctions, loss of licenses and reputational harm. Compliance programs and audits reduce this exposure.
3. A US healthcare provider handling patient records must comply primarily with which regulation?
- PCI DSS for cards
- HIPAA for health data (correct answer)
- FERPA for schools
- SOX for accounting
HIPAA governs protected health information (PHI) handling in US healthcare. Match the data type to the regulation: cards=PCI DSS, education=FERPA, financial reporting=SOX.
4. A privacy law lets residents demand a business delete the personal data it holds on them. This right is:
- The right to encryption
- The right to be forgotten (correct answer)
- The right to more storage
- The right to shared access
The right to be forgotten (erasure), in GDPR/CCPA, lets individuals request deletion of their personal data, subject to legal exceptions. It's part of data-subject rights.
5. A hospital ignores required safeguards and suffers a large data breach. The MOST likely regulatory outcome is:
- Faster patient check-ins
- Fines and legal penalties (correct answer)
- Reduced audit scrutiny
- Automatic cyber-insurance
Non-compliance leading to a breach commonly brings fines, legal penalties, mandatory reporting and reputational harm (e.g., under HIPAA). Compliance controls reduce this risk.
6. A privacy principle says to collect only the personal data actually needed for a stated purpose. This is:
- Data maximization
- Data minimization (correct answer)
- Data replication
- Data aggregation
Data minimization collects only what's necessary for the stated purpose, reducing exposure and compliance burden. It pairs with purpose limitation and consent under privacy laws.