A policy is a general statement of management's intent, and
therefore, a policy would not specify the encryption scheme to be
used. The other answers are appropriate for a cryptographic policy.
The general standards document is BSI ISO/IEC 17799:2000,BS 7799-
I: 2000, Information technology-Code of practice for information security management, British Standards Institution, London , UK . The standard is intended to provide a comprehensive set of controls comprising best practices in information security. ISO refers to the
International Organization for Standardization and IEC is the
International Electrotechnical Commission. These two entities form
the system for worldwide standardization.
The main chapter headings of the standard are:
Security Policy
Organizational Security
Asset Classification and Control
Personnel Security
Physical and Environmental Security
Communications and Operations Management
Access Control
Systems Development and Maintenance
Business Continuity Management
Compliance

FIPS publications are issued by NIST after approval by the Secretary of
Commerce pursuant to Section 5131 of the Information Technology Reform Act of 1996,
Public Law 104-106, and the FISMA Act of 2002.
The following answers are incorrect because :
The National Computer Security Center (NCSC) was established in 1981 within NSA to help support and drive NSA's DoD computer security responsibilities.
The National Security Agency (NSA) is incorrect because NSA does not publish FIPS and is the agency officially responsible for security within the US government.
The American National Standards Institute (ANSI) is also incorrect as ANSI does not publish FIPS and is an organization that defines coding standards and signaling schemes in the United States and represents the United States in ISO and the International
Telecommunication Union (ITU).
Reference : Shon Harris AIO v3 , Appendix B : Who's Who

The recovery point objective (RPO) is the maximum acceptable level of data loss following an unplanned "event", like a disaster (natural or man-made), act of crime or terrorism, or any other business or technical disruption that could cause such data loss. The RPO represents the point in time, prior to such an event or incident, to which lost data can be recovered (given the most recent backup copy of the data).
The recovery time objective (RTO) is a period of time within which business and / or technology capabilities must be restored following an unplanned event or disaster. The RTO is a function of the extent to which the interruption disrupts normal operations and the amount of revenue lost per unit of time as a result of the disaster.
These factors in turn depend on the affected equipment and application(s). Both of these numbers represent key targets that are set by key businesses during business continuity and disaster recovery planning; these targets in turn drive the technology and implementation choices for business resumption services, backup / recovery / archival services, and recovery facilities and procedures.
Many organizations put the cart before the horse in selecting and deploying technologies before understanding the business needs as expressed in RPO and RTO; IT departments later bear the brunt of user complaints that their service expectations are not being met. Defining the RPO and RTO can avoid that pitfall, and in doing so can also make for a compelling business case for recovery technology spending and staffing.
For the CISSP candidate studying for the exam, there are no such objectives for "point of time," and "critical time." Those two answers are simply detracters.
Reference:
http://www.wikibon.org/Recovery_point_objective_/_recovery_time_objective_strategy

Data sovereignty is the term used to define where data is geographically stored in the cloud. Data sovereignty refers to the legal and regulatory framework that governs the data based on the location or jurisdiction where it resides. Data sovereignty can affect the cloud service provider's and the cloud customer's obligations and responsibilities regarding data protection, privacy, security, compliance, and access. For example, some countries may have strict data sovereignty laws that require the data to be stored and processed within their borders, and prohibit the data from being transferred or accessed by foreign entities. The other options are not correct. Data warehouse is a term used to describe a centralized repository of data that is used for analysis and reporting. Data privacy rights and data subject rights are terms used to describe the rights and choices that individuals have over their personal data, such as the right to access, correct, delete, or restrict the processing of their data. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Communication and Network Security, page 633. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 5: Communication and Network Security, page 634.

Cutover test: Recovery systems are built/set up to assume the full production workload. You disconnect primary systems.