13. Sectoral Compliance and Critical Digital InfrastructureIntroduction and ContextCyber law and data privacy are often presented as horizontal disciplines: rules that apply across all organizations regardless of their business model. That view is incomplete. The consequences of a failure in a hospital, bank, telecommunications network, government identity system, payment processor, or electricity control centre are materially different. Sectoral regulation therefore supplements general privacy and cybersecurity law with obligations shaped by the sensitivity of the service, the vulnerability of affected persons, the systemic consequences of disruption, and the public interest involved. Sectoral compliance is the process of identifying and satisfying legal, regulatory, contractual, technical, and governance obligations applicable to a particular industry. It may regulate the collection and use of information, security controls, outsourcing, incident reporting, business continuity, customer protection, auditability, retention, professional secrecy, or access by public authorities. Critical digital infrastructure is the broader technological environment whose disruption could seriously affect public safety, economic stability, public health, national security, or the functioning of government. It includes both traditional industrial systems and digital platforms on which essential services depend. The central issue is not simply whether an organization possesses adequate security tools. Regulators increasingly ask whether the organization understands its dependencies, can continue essential operations during disruption, can detect and report incidents promptly, can protect individuals from foreseeable harm, and can demonstrate accountable decision-making. Compliance is therefore closely connected with operational resilience, enterprise risk management, privacy governance, and organizational leadership. Learning ObjectivesAfter studying this chapter, the learner should be able to: 1. Explain why sectoral regulation exists alongside general cyber and privacy law. 2. Compare compliance expectations in finance, healthcare, telecommunications, government, payments, consumer services, and child-focused services. 3. Distinguish critical infrastructure, critical information infrastructure, essential services, and ordinary business systems. 4. Apply a risk-based framework for sectoral compliance and operational resilience. 5. Evaluate incident response, third-party risk, continuity, and supervisory expectations. 6. Analyse ethical and governance problems arising from surveillance, automated decisions, data sharing, and competing public interests. 7. Design practical compliance measures for organizations operating essential digital services. Why Sectoral Compliance MattersGeneral privacy statutes typically establish principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, security, and accountability. Cybersecurity statutes may impose offences, incident-reporting duties, or baseline security requirements. Sectoral rules add context. A financial institution may be required to manage liquidity and fraud risks, preserve transaction records, authenticate customers, and maintain recovery capability. A hospital must protect clinical confidentiality while ensuring that clinicians can access records during emergencies. A telecommunications operator may have duties relating to lawful access, emergency communications, network availability, and subscriber data. A platform directed at children must consider developmental vulnerability and the risks of profiling. Sectoral rules commonly differ in four ways. First, they identify specific risk scenarios, such as payment fraud, medical errors, service outages, or unauthorized disclosure of government information. Second, they assign responsibility to specialized officers, boards, or regulated entities. Third, they establish supervisory powers, including examinations, directions, sanctions, and approval requirements. Fourth, they often prescribe resilience and reporting outcomes rather than merely requiring a written policy. Organizations frequently face overlapping obligations. A health insurer, for example, may be subject to privacy law, insurance regulation, financial-sector outsourcing requirements, employment law, and breach-notification rules. Compliance cannot be managed effectively by treating each law as an isolated checklist. The organization must construct a legal and technical obligations register, identify the strictest applicable requirement where rules overlap, document interpretations, and establish evidence that controls operate in practice. A Risk-Based Model for Sectoral ComplianceA useful compliance model connects five layers: criticality, data, threats, controls, and assurance. Criticality asks what would happen if a service became unavailable, unreliable, or compromised. The analysis should consider human safety, economic loss, public confidence, national security, and the availability of alternatives. A short interruption to an entertainment website is not equivalent to an interruption to emergency communications. Data analysis identifies what information is processed, whose information it is, where it moves, how long it is retained, and what harm could result from misuse. Classification should cover personal, sensitive, confidential, regulated, operational, and safety-related information. Threats include external attacks, insider misuse, fraud, supply-chain compromise, software defects, physical events, geopolitical actions, and accidental disclosure. Threat modelling should reflect the sector rather than rely only on generic threat catalogues. Controls include preventive, detective, responsive, and recovery measures. Examples include identity and access management, encryption, network segmentation, secure development, transaction monitoring, backup, redundancy, privacy-enhancing technologies, and tested crisis procedures. Assurance demonstrates that controls are designed appropriately and work consistently. Evidence may include audit trails, penetration-test results, recovery exercises, access reviews, supplier assessments, incident records, board reports, and regulator correspondence. This model supports proportionality. A small service provider should not be exempt from meaningful security, but controls should reflect its risk, resources, and role in the service chain. Conversely, a large operator cannot claim compliance merely because it has formal policies if it cannot restore essential services or explain decisions to a regulator. Sector-Specific Regulatory LandscapesFinancial Services and InsuranceFinancial institutions are attractive targets because they hold valuable assets, identity information, transaction data, and privileged access to economic systems. Their compliance obligations generally extend beyond confidentiality. Integrity and availability are equally important: altered balances, fraudulent payments, inaccurate credit information, or prolonged service outages can cause immediate and systemic harm. Supervisory expectations commonly include board oversight, a documented information-security programme, risk assessments, segregation of duties, privileged-access control, fraud monitoring, secure software development, resilience testing, incident escalation, and management of third-party technology providers. Institutions are expected to understand concentration risk—for example, whether multiple critical services depend on one cloud provider, telecommunications carrier, identity service, or software supplier. Outsourcing does not transfer regulatory accountability. Contracts should define security requirements, audit rights, data location and access, incident notification, subcontracting, service levels, recovery objectives, exit assistance, and secure deletion. A regulated institution should also test whether it can operate if the provider becomes unavailable or refuses access to relevant evidence. Healthcare and Life SciencesHealthcare data often combines identity, financial, genetic, clinical, and highly intimate information. Its compromise may cause discrimination, embarrassment, insurance consequences, or physical harm. At the same time, excessive confidentiality controls can obstruct emergency treatment. Healthcare compliance therefore requires a balance between confidentiality, availability, clinical usefulness, and patient autonomy. Important measures include role-based access, emergency access procedures, audit logging, strong authentication, secure medical devices, data-quality controls, privacy notices, research governance, retention schedules, and tested downtime procedures. Medical devices and hospital operational technology require special attention because patching may affect safety or regulatory approval. A hospital must know which systems are essential for medication administration, diagnostics, surgery, communications, and patient identification, and must maintain safe manual or alternative processes. Secondary uses of health data raise difficult questions. Research, public health, artificial intelligence, and quality improvement may produce substantial social benefits, but organizations must establish lawful authority, ethical review, minimization, de-identification or pseudonymization, access restrictions, and safeguards against re-identification. De-identification is not automatically permanent; linkage with other datasets may restore identifiability. Telecommunications and Digital CommunicationsTelecommunications operators provide the connectivity on which other sectors depend. Their obligations may include network security, service availability, protection of subscriber information, lawful interception processes, emergency calling, cooperation with competent authorities, spam and fraud controls, and retention or disclosure rules established by applicable law. The sector illustrates the tension between security and surveillance. Lawful access should be based on clear legal authority, necessity, proportionality, authorization, access controls, auditability, and limits on secondary use. Technical personnel should not create informal access channels merely because a government request appears urgent. At the same time, operators must protect lawful communications from unauthorized interception and insider misuse. Network functions are increasingly virtualized and software-defined. This improves flexibility but expands dependence on centralized orchestration, application programming interfaces, remote administration, and software suppliers. Segmentation, secure configuration, identity assurance, supply-chain review, resilience of signaling systems, and rapid isolation of compromised components are essential. Government and Public Digital ServicesGovernment systems process identity, taxation, benefits, immigration, education, health, policing, and national-security information. A cyber incident may therefore affect rights, access to public services, democratic trust, and personal safety. Government compliance must address not only security but also legality, administrative fairness, records management, accessibility, transparency, and public accountability. Digital identity systems deserve particular care. A compromised credential can enable access across many agencies, while an erroneous identity match may deny a person a benefit or expose another person’s records. Strong identity proofing, multifactor authentication, correction procedures, independent oversight, separation of functions, and appeal mechanisms are necessary. Automated eligibility or risk scoring should be explainable to the extent required by law and should include human review where significant rights or benefits are affected. Public bodies also face archival duties and freedom-of-information requirements. Deleting data too early may undermine accountability; retaining it indefinitely may increase privacy and security risk. Retention must be linked to legal purpose, evidentiary value, public records rules, and minimization principles. Payment Systems and FintechPayment systems are distinct from general financial services because they operate at high speed and involve multiple interconnected participants: issuers, acquirers, merchants, payment processors, wallets, authentication providers, and clearing or settlement systems. A weakness at one participant can produce fraud or operational disruption across the ecosystem. Compliance commonly emphasizes customer authentication, transaction monitoring, tokenization, secure interfaces, dispute handling, segregation of payment data, fraud intelligence, rapid blocking and recovery, and availability. Application programming interfaces must be governed through authentication, authorization, rate controls, input validation, monitoring, and lifecycle management. Real-time fraud analytics can reduce losses but may generate false positives and unfairly exclude customers. Organizations should provide review and remediation channels and monitor outcomes across demographic groups where legally and ethically appropriate. Children and Young PeopleChildren are not merely ordinary users with less experience. Their developing capacity, dependence on adults, and susceptibility to manipulation justify stronger safeguards. Services likely to be accessed by children should consider age assurance, child-appropriate notices, default privacy settings, minimization, limits on profiling and targeted advertising, parental controls that respect the child’s interests, and safe reporting mechanisms. Age assurance itself creates privacy risks. Collecting identity documents or biometric information from every user may be disproportionate. A risk-based approach should assess the service, select the least intrusive reliable method, avoid retaining evidence unnecessarily, and provide alternatives for users who cannot complete verification. Design teams should test whether engagement features encourage excessive use, disclosure, contact with strangers, or exposure to harmful content. Consumer Platforms and Digital CommerceConsumer-protection obligations intersect with cyber and privacy duties. Organizations should provide clear terms, honest security representations, transparent data practices, reasonable account-recovery processes, and timely notification of material incidents. Dark patterns—interfaces that manipulate users into accepting tracking, sharing more data, or purchasing unwanted services—may undermine meaningful consent and create regulatory exposure. Account security is a shared but not equal responsibility. Consumers can use strong credentials and multifactor authentication, but organizations control architecture, recovery design, fraud detection, and breach response. A company should not shift all loss to the customer when its own weak authentication or monitoring materially contributed to the event. Critical Digital Infrastructure and Operational ResilienceCritical infrastructure includes assets, systems, networks, and services whose disruption would have serious consequences for society. Critical digital infrastructure focuses on the digital elements that operate, control, coordinate, or support those services. Examples include energy management systems, water treatment controls, transport signalling, hospital platforms, payment clearing, cloud infrastructure supporting government, and communications networks. A criticality assessment should examine not only individual assets but also dependencies and interdependencies. A data centre may depend on electricity, cooling, telecommunications, physical security, specialized vendors, and accurate time synchronization. An airport may depend on identity systems, baggage systems, payment services, weather data, and external communications. Failure can cascade across sectors. Operational resilience is the ability to continue delivering important services within acceptable limits during disruption and to learn from incidents. It differs from business continuity understood as a document describing recovery steps. Resilience requires identifying important business services, setting impact tolerances, mapping people, processes, technology, facilities, and suppliers, designing alternatives, testing severe but plausible scenarios, and improving after exercises or real events. A mature resilience programme normally includes: - critical-service mapping and dependency analysis;
- recovery time and recovery point objectives, with explicit impact tolerances;
- diverse communications and power arrangements;
- offline or immutable backups and restoration testing;
- segmentation between information technology and operational technology;
- crisis-management authority and escalation paths;
- manual or degraded-mode operating procedures;
- supplier exit and substitution planning; and
- post-incident learning and independent challenge.
Resilience is not unlimited redundancy. Redundancy that shares the same software flaw, identity provider, geographic location, or supplier may create an illusion of safety. Testing should therefore include dependency failure, corrupted data, insider compromise, ransomware, loss of communications, prolonged cloud outage, and simultaneous incidents. Supervisory Expectations and EvidenceRegulators increasingly assess outcomes and organizational behaviour. They may ask whether senior leaders understand the organization’s most important services, whether risk information reaches the board in usable form, whether security budgets reflect material risk, whether incidents are reported candidly, and whether weaknesses are remediated within defined timeframes. Effective evidence is specific and traceable. A statement that “access is reviewed regularly” is weaker than records showing the population reviewed, reviewer, exceptions, decisions, dates, and follow-up. Similarly, an incident plan is not persuasive unless exercises demonstrate that contact lists work, decision rights are understood, evidence is preserved, communications are coordinated, and recovery targets are realistic. Regulatory reporting must be accurate, timely, and appropriately qualified. Organizations should avoid both under-reporting and speculative overstatement. Legal, technical, privacy, communications, and executive teams should coordinate without delaying urgent notifications. Reports should distinguish known facts, assumptions, uncertainty, affected services, containment measures, and planned updates. Illustrative Case Study: The Regional Health-Payment NetworkBackgroundThe fictional Meridian Care Network operates hospitals, outpatient clinics, a health-insurance administrator, and an online payment portal. Clinical records are hosted by a cloud provider, while payment processing is supplied by a fintech company. The network uses a shared identity platform for clinicians, patients, and administrative staff. SituationAn attacker obtains credentials for a contractor and enters the identity platform. The attacker creates an additional privileged account, encrypts several file servers, and disrupts the payment portal. Clinical systems remain partially available, but medication histories are delayed and some clinics revert to paper records. The cloud provider detects unusual activity but notifies Meridian twelve hours later because the contract contains an ambiguous incident clause. AnalysisThe event is simultaneously a privacy incident, a healthcare-safety event, a payment-system disruption, a third-party governance failure, and a resilience test. Focusing only on stolen personal data would miss the danger created by delayed clinical information and unreliable payment reconciliation. The shared identity platform created concentration risk: compromise of one service affected multiple operational areas. The contractor’s access was excessive and not subject to timely review. Approach and StrategyMeridian activates its crisis team, separates clinical and administrative networks, disables the contractor’s credentials, preserves forensic evidence, and establishes a verified emergency communication channel. Clinical leaders prioritize medication, surgery, emergency care, and patient identification. Payment operations suspend questionable transactions and reconcile them through an independent process. The privacy officer assesses affected data, while legal and compliance teams determine notification duties to regulators, patients, insurers, and payment partners. After stabilization, Meridian replaces standing privileged access with time-limited privilege, implements phishing-resistant multifactor authentication, and establishes separate identity domains for critical clinical functions. Contracts are revised to require rapid notification, cooperation, audit rights, recovery testing, and clear responsibility. The network conducts a severe-but-plausible exercise involving simultaneous cloud and telecommunications failure. OutcomeThe organization restores priority services using clean backups and documented degraded-mode procedures. It discovers that recovery point objectives had been approved but never tested for two essential databases. The board therefore links resilience metrics to executive performance, funds alternative communications, and requires quarterly reporting on critical suppliers and unresolved high-risk findings. Learning PointsThe case demonstrates that sectoral compliance is interconnected. A healthcare organization must protect privacy, but it must also preserve safe treatment. Third-party contracts, identity architecture, recovery testing, and clinical governance are not separate topics. Compliance becomes credible when legal obligations are translated into operational capabilities and tested under pressure. Difficulties, Limitations, and Common ErrorsA common error is treating compliance as certification rather than continuous risk management. Another is assigning responsibility to the security team while business owners, suppliers, and senior management remain uninvolved. Organizations may also confuse availability with resilience, assuming that redundant systems will work without restoration testing. Other recurrent weaknesses include incomplete asset inventories, excessive privileges, unreviewed service accounts, vague supplier clauses, unsupported legacy technology, poor evidence retention, incompatible reporting obligations, and incident plans that exclude privacy, communications, procurement, or clinical personnel. Excessive data collection is sometimes justified as security, although unnecessary data increases breach impact and regulatory exposure. Sectoral regulation also has limitations. Rules may lag behind technology, overlap inconsistently, or encourage formal compliance without improving real security. Prescriptive controls can become obsolete, while purely outcome-based regulation may be uncertain for smaller organizations. Professional judgment is therefore necessary, supported by documented risk acceptance, independent challenge, and proportional safeguards. Governance, Ethics, and Emerging DevelopmentsSectoral cybersecurity decisions involve ethical choices about whose interests receive priority. Monitoring may protect a network but intrude on workers or customers. Fraud analytics may reduce losses but unfairly block legitimate users. Health-data research may benefit society while exposing vulnerable groups. Government data sharing may improve service delivery but enable unjustified surveillance. Legality is essential but does not eliminate the need for necessity, proportionality, fairness, accountability, and respect for human dignity. Artificial intelligence is being used for anomaly detection, fraud prevention, medical analysis, vulnerability prioritization, and incident triage. These applications require reliable data, human oversight, model monitoring, secure development, protection against manipulation, and procedures for erroneous outcomes. Organizations should know whether sensitive data is used to train a model, where processing occurs, and how outputs affect individuals or essential services. Emerging regulatory attention is also directed toward software supply chains, cloud concentration, digital operational resilience, connected medical and industrial devices, ransomware reporting, quantum-resistant cryptography planning, and secure-by-design products. The direction of travel is clear: organizations are expected to prevent foreseeable harm, reduce dependency risk, report material incidents, and demonstrate that resilience has been tested rather than assumed. Best-Practice Implementation RoadmapAn organization beginning or renewing a sectoral compliance programme should proceed in a disciplined sequence: 1. Identify applicable laws, regulators, contractual duties, licences, and recognized standards. 2. Define essential services, regulated data, critical assets, and impact tolerances. 3. Map dependencies, including suppliers, cloud services, communications, facilities, and personnel. 4. Assign board-level accountability and operational ownership. 5. Assess threats and gaps using sector-relevant scenarios. 6. Implement proportionate technical, administrative, physical, and privacy controls. 7. Establish incident reporting, crisis decision-making, and evidence-preservation procedures. 8. Test recovery, degraded operations, supplier failure, and communication arrangements. 9. Measure control performance and remediate recurring weaknesses. 10. Review the programme after regulatory change, major technology change, incidents, and exercises. This roadmap should be adapted to the organization’s role. A small supplier may concentrate on access control, secure development, backup, incident escalation, and contractual clarity, while a national operator may require systemic risk analysis, sector coordination, and independent resilience testing. Chapter SummarySectoral compliance gives practical meaning to general cyber and privacy principles by addressing the distinctive risks of particular industries. Finance emphasizes systemic integrity and fraud resistance; healthcare balances confidentiality with safe availability; telecommunications protects networks and subscriber information; government must combine security with legality and administrative fairness; payment systems require rapid, interconnected fraud and availability controls; child-focused services demand heightened protection; and consumer platforms must avoid deceptive data and security practices. Critical digital infrastructure must be assessed through dependencies, impact tolerances, operational technology, suppliers, and cascading consequences. Operational resilience requires more than policies: it requires mapping important services, maintaining alternatives, testing recovery, preserving evidence, and learning from disruption. Supervisors increasingly evaluate leadership, outcomes, third-party governance, incident transparency, and the quality of evidence. Effective programmes are risk-based, proportionate, ethically aware, technically grounded, and continuously improved. Key TermsSectoral compliance: Conformity with legal, regulatory, contractual, and professional requirements applicable to a particular industry. Critical infrastructure: Assets, systems, networks, or services whose disruption could seriously affect society, the economy, public health, safety, or government. Critical digital infrastructure: Digital systems that operate, control, coordinate, or support critical services. Operational resilience: The capability to continue important services within acceptable limits during disruption and to learn from incidents. Impact tolerance: The maximum tolerable level of disruption to an important service. Third-party risk: Risk arising from suppliers, contractors, platforms, cloud providers, or other external dependencies. Concentration risk: Excessive dependence on one provider, technology, location, or shared component. Operational technology: Technology that monitors or controls physical processes and equipment. Degraded-mode operation: Delivery of essential functions using reduced or alternative processes during disruption. Data minimization: Limiting personal-data collection and use to what is necessary for a legitimate purpose. Pseudonymization: Processing data so that direct identification requires additional separately protected information. Identity and access management: Processes and technologies governing identification, authentication, authorization, and access review. Privileged access: Access capable of administering systems, changing security controls, or affecting critical operations. Incident escalation: Timely transfer of an event to appropriate operational, legal, executive, or regulatory authorities. Supply-chain security: Protection of software, hardware, services, and relationships across the technology supply chain. Supervisory expectation: A regulator’s view of the governance, controls, and outcomes that a regulated organization should demonstrate. Impact assessment: Structured analysis of likely consequences arising from processing, disruption, or security failure. Secure-by-design: Incorporating security and privacy into products and services from their earliest design stages. Review QuestionsShort Answer Questions1. Why do sectoral regulations supplement general privacy and cybersecurity laws? 2. Define operational resilience and distinguish it from a business continuity document. 3. What is concentration risk in critical digital infrastructure? 4. Why is healthcare compliance required to balance confidentiality and availability? 5. Identify two supervisory expectations concerning third-party technology providers. Long Answer Questions1. Explain the five-layer risk-based model for sectoral compliance and illustrate its application to a payment processor. 2. Discuss the major cybersecurity and privacy obligations typically affecting telecommunications operators. 3. Analyse the special governance challenges involved in protecting children’s data and designing age assurance. 4. Explain how dependency mapping and impact tolerances contribute to critical-infrastructure resilience. 5. Discuss why outsourcing does not transfer regulatory accountability, using financial or healthcare services as an example. Analytical / Application Questions1. A hospital’s cloud provider reports a ransomware incident after clinical systems become intermittently unavailable. Develop a coordinated legal, privacy, clinical, technical, and communications response. 2. A government proposes using an AI model to deny welfare benefits automatically based on identity and fraud-risk scores. Evaluate the proposal using security, privacy, fairness, accountability, and administrative-law considerations. 3. A national payment service relies on one cloud provider, one identity platform, and one telecommunications carrier. Design a resilience assessment and recommend measures to reduce systemic concentration risk. 22. Multiple Choice Questions with AnswersQuestion 1What best distinguishes sectoral compliance from general cybersecurity compliance? A. It applies only to organizations that operate internationally. B. It adapts legal and control requirements to the risks and public consequences of a particular industry. C. It replaces all general privacy obligations with industry-specific rules. D. It focuses exclusively on technical security tools. Correct Answer: B. It adapts legal and control requirements to the risks and public consequences of a particular industry. Question 2Why is operational resilience broader than business continuity planning? A. It eliminates the need for backup systems. B. It concerns only physical facilities and emergency evacuation. C. It requires mapping important services, dependencies, impact tolerances, testing, and learning from disruption. D. It applies only to government organizations. Correct Answer: C. It requires mapping important services, dependencies, impact tolerances, testing, and learning from disruption. Question 3Which situation best illustrates concentration risk? A. A company uses two different password managers. B. Several essential services depend on the same cloud provider and identity platform. C. A hospital classifies records by sensitivity. D. A payment provider conducts quarterly access reviews. Correct Answer: B. Several essential services depend on the same cloud provider and identity platform. Question 4Why must healthcare organizations balance confidentiality with availability? A. Clinical information has no privacy value during emergencies. B. Excessive access restrictions can delay treatment or create safety risks. C. Healthcare systems are exempt from privacy regulation. D. Availability is always legally more important than confidentiality. Correct Answer: B. Excessive access restrictions can delay treatment or create safety risks. Question 5Which contractual provision is most relevant to managing a critical technology supplier? A. A prohibition on all internal audits by the customer. B. A clause allowing unlimited subcontracting without notification. C. Clear incident notification, audit, recovery, cooperation, and exit requirements. D. A promise that the supplier will never experience an incident. Correct Answer: C. Clear incident notification, audit, recovery, cooperation, and exit requirements. Question 6A child-focused service wants to verify age by retaining identity documents indefinitely. What is the strongest compliance concern? A. Age assurance can never be used lawfully. B. Indefinite retention may be disproportionate and create unnecessary privacy and security risk. C. Children should always disclose more information than adults. D. Identity documents cannot be used for any security purpose. Correct Answer: B. Indefinite retention may be disproportionate and create unnecessary privacy and security risk. Question 7What is the principal governance risk of an automated government eligibility system? A. Automation makes record keeping impossible. B. It may produce opaque or erroneous decisions affecting rights without meaningful review or appeal. C. Government systems cannot use authentication. D. Automated systems eliminate the need for legal authority. Correct Answer: B. It may produce opaque or erroneous decisions affecting rights without meaningful review or appeal. Question 8In the Meridian Care Network case, why was the shared identity platform especially significant? A. It prevented all clinical access during the incident by design. B. It created a common point through which compromise could affect several operational areas. C. It was unrelated to contractor access. D. It removed the need for network segmentation. Correct Answer: B. It created a common point through which compromise could affect several operational areas. Question 9Which evidence would most convincingly demonstrate that access reviews operate effectively? A. A policy stating that reviews occur regularly. B. A presentation describing the importance of access control. C. Records showing the reviewed population, decisions, exceptions, dates, and follow-up actions. D. A general statement that no breach has occurred. Correct Answer: C. Records showing the reviewed population, decisions, exceptions, dates, and follow-up actions. Question 10Why can redundancy fail to provide genuine resilience? A. Redundancy always increases privacy risk. B. Redundant components may share the same software, supplier, location, or dependency. C. Redundancy is relevant only to financial institutions. D. Backup systems cannot be tested. Correct Answer: B. Redundant components may share the same software, supplier, location, or dependency.
|
