Section: Volume C
Explanation:
HIPAA handles health care information of an organization.
The Health Insurance Portability and Accountability Act (HIPAA) were introduced in 1996. It ensures that health information data is protected. Before HIPAA, personal medical information was often available to anyone.
Security to protect the data was lax, and the data was often misused.
If your organization handles health information, HIPAA applies. HIPAA defines health information as any data that is created or received by health care providers, health plans, public health authorities, employers, life insurers, schools or universities, and health care clearinghouses.
HIPAA defines any data that is related to the health of an individual, including past/present/future health, physical/mental health, and past/present/future payments for health care.
Creating a HIPAA compliance plan involves following phases:
* Assessment: An assessment helps in identifying whether organization is covered by HIPAA. If it is, then further requirement is to identify what data is needed to protect.
* Risk analysis: A risk analysis helps to identify the risks. In this phase, analyzing method of handling data of organization is done.
* Plan creation: After identifying the risks, plan is created. This plan includes methods to reduce the risk.
* Plan implementation: In this plan is being implemented.
* Continuous monitoring: Security in depth requires continuous monitoring. Monitor regulations for changes.
Monitor risks for changes. Monitor the plan to ensure it is still used.
* Assessment: Regular reviews are conducted to ensure that the organization remains in compliance.
Incorrect Answers:
A: GLBA is not used for handling health care information.
C: SOX designed to hold executives and board members personally responsible for financial data.
D: FISMA ensures protection of data of federal agencies.

According to the Key Performance Indicators for Vulnerability Management article, the number of vulnerabilities remediated is a key performance indicator that measures the effectiveness of a vulnerability remediation program. This KPI indicates how many vulnerabilities have been successfully mitigated or fixed within a given time frame. A higher number can imply that the organization is effectively managing its exposures and reducing its risk level. The number of vulnerabilities remediated can also be compared with the number of new vulnerabilities identified to evaluate the progress and performance of the vulnerability remediation program. References = Key Performance Indicators for Vulnerability Management

Section: Volume B
Explanation/Reference:
Explanation:
The risk exposure for this event is found by multiplying the risk impact by the risk probability.
Risk Exposure is a straightforward estimate that gives a numeric value to a risk, enabling different risks to be compared.
Risk Exposure of any given risk = Probability of risk occurring x impact of risk event
= 0.70 * 350,000
= 245,000
Incorrect Answers:
A: $350,000 is the impact of the risk event.
B: $500,000 is the project's budget.
C: $850,000 is the project's budget and the risk's impact.

Section: Volume A
Explanation:
All identified risk events should be entered into the risk register.
A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:
* A description of the risk
* The impact should this event actually occur
* The probability of its occurrence
* Risk Score (the multiplication of Probability and Impact)
* A summary of the planned response should the event occur
* A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event)
* Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.
Incorrect Answers:
A: Before the risk events are analyzed they should be documented in the risk register.
B: The risks should first be documented and analyzed.
D: These risks should first be identified, documented, passed through qualitative risk analysis and then it should be determined if they should pass through the quantitative risk analysis process.