Examkin

Question

Difficulty: HardRegulatory Compliance and Legal Requirements Management

An enterprise risk and compliance officer is updating the organization's regulatory tracking matrix across specialized business sectors and global jurisdictions. Match each regulatory framework or legal mandate on the left with its primary governance scope and compliance requirement on the right.

  • NIS 2 DirectiveEnforces strict baseline cybersecurity management, supply chain security, and stringent incident notification timelines across critical infrastructure and essential service entities in the European Union.
  • CMMC (Cybersecurity Maturity Model Certification)Establishes a standardized verification program requiring defense contractors to undergo third-party or self-assessments to ensure protection of Controlled Unclassified Information (CUI).
  • COPPA (Children's Online Privacy Protection Act)Mandates verifiable parental consent before collecting, using, or disclosing personal information from operators of commercial websites targeted at children under 13 years of age.
  • FERPA (Family Educational Rights and Privacy Act)Protects the privacy of student educational records by restricting non-consensual disclosure of personally identifiable information maintained by educational agencies or institutions receiving federal funding.

Answer

NIS 2 Directive matches the EU critical infrastructure baseline and incident reporting mandate; CMMC matches the US defense contractor verification for Controlled Unclassified Information; COPPA matches the requirement for verifiable parental consent for children under 13; FERPA matches the protection of student educational records in federally funded institutions.
Each regulation is paired accurately according to its governing body, protected data type, and compliance obligations: NIS 2 Directive sets EU critical infrastructure incident reporting standards; CMMC enforces cybersecurity verification for US defense contractors handling CUI; COPPA mandates parental consent for online services handling data of children under 13; and FERPA protects student educational records in US educational institutions.

Step-by-Step Solution

1
Analyze the legal domain and jurisdiction for each compliance framework listed on the left.
Identified NIS 2 as European Union critical infrastructure law, CMMC as US Defense Industrial Base standards, COPPA as US online children's privacy law, and FERPA as US educational record privacy law.
Regulatory compliance frameworks differ significantly based on geographic jurisdiction, sector (defense, education, critical infrastructure), and target demographic.
2
Map each framework to its specific legal mandate and data protection scope.
Matched NIS 2 Directive with EU critical infrastructure requirements, CMMC with defense CUI protection, COPPA with children under 13 parental consent rules, and FERPA with student record privacy.
Accurate alignment requires identifying the governing authority, affected data classification (e.g., CUI, student records, children's PII), and enforced controls.

Key Concept

Regulatory Framework Mapping and Jurisdictional Scope
Rate this question

Topics

Regulatory Compliance and Legal Requirements Management

More questions from this topic