Information Technology Specialist (ITS) Cybersecurity Practice Exam

Which compliance act establishes a framework for U.S. federal agencies regarding data protection?

1. HIPAA

2. SOX

3. FISMA

4. GDPR

The correct answer is: FISMA

The compliance act that establishes a framework for U.S. federal agencies regarding data protection is FISMA, or the Federal Information Security Management Act. Enacted in 2002, FISMA sets forth a comprehensive framework to protect government information, operations, and assets against natural or man-made threats. It requires federal agencies to develop, document, and implement comprehensive information security programs to ensure that their data is adequately protected. Under FISMA, agencies must conduct risk assessments, implement security controls, and ensure compliance through regular evaluations and assessments of their security programs. This act emphasizes the importance of securing government data, given the critical nature of the information handled by these agencies. In contrast, HIPAA (the Health Insurance Portability and Accountability Act) specifically deals with healthcare data protection; SOX (the Sarbanes-Oxley Act) focuses on the accuracy of financial disclosures within publicly traded companies; and GDPR (the General Data Protection Regulation) is a European regulation that governs data protection and privacy in the European Union, without direct applicability to U.S. federal agencies. Therefore, FISMA is the correct choice as it directly addresses the needs and responsibilities of federal agencies concerning data protection.