Compliance Frameworks and Certification Standards Questions

The major security compliance frameworks and how to achieve and maintain certification against them: SOC 2, ISO 27001, NIST CSF, NIST 800-53, CIS Controls, PCI DSS, and FedRAMP. Covers what each framework governs, how control families map to organizational practices, and how to scope, prepare for, and pass a certification assessment. Emphasizes framework selection and reconciling overlapping control requirements across standards.

HardTechnical

57 practiced

You lead privacy due diligence for an M&A target that processes personal data across the US and EU. Evaluate whether ISO/IEC 27701 certification or SOC 2 Privacy criteria provides better assurance for privacy risks. Discuss auditor credibility, scope alignment with legal requirements, cost/time to obtain, and practical implications for post-merger integration.

Sample Answer

**Direct recommendation (short)** Both certifications add value but serve different needs: ISO/IEC 27701 is stronger for legal alignment with EU GDPR and programmatic privacy management; SOC 2 Privacy is more practical for US customers and transactional assurance. I’d prioritize ISO 27701 if GDPR risk is the priority; choose SOC 2 Privacy if rapid commercial assurance for US customers matters most.

**Auditor credibility** - ISO/IEC 27701: requires accredited certification bodies (IAF signatories). Auditors follow national accreditation schemes → higher consistency for legal/regulatory scrutiny. - SOC 2 Privacy: performed by licensed CPA firms; market-recognized in US financial/legal contexts. Quality varies by firm; rely on Big Four or reputable firms for stronger credibility.

**Scope alignment with legal requirements** - ISO/27701: maps directly to GDPR articles (data subject rights, DPIAs, processors/controllers). Better for meeting EU supervisory expectations. - SOC 2 Privacy: controls-based against AICPA privacy criteria; covers lifecycle but not explicit legal mappings—supplement with legal gap analysis for GDPR.

**Cost / time to obtain** - ISO/27701: typically 6–12 months program build + certification audits; higher cost for consultancy and remediation. - SOC 2 Privacy: often 3–6 months to readiness and Type I/II cycles; faster to market but recurring audit cadence.

**Practical implications for post-merger integration** - ISO/27701: simplifies harmonizing policies, DPIAs, cross-border transfer mechanisms (SCCs, binding rules). Use as baseline to align EU operations. - SOC 2 Privacy: useful to quickly assure customers and integrate operational controls (access, logging, vendor management). May need ISO-led work to close legal gaps.

**As Security Architect — recommended approach** - Combine: pursue SOC 2 Privacy first for rapid commercial assurance, plan ISO/27701 in parallel for legal/regulatory alignment in EU. - Actions: choose accredited/cpa auditors with M&A experience, map both frameworks to GDPR/US state laws in a unified control matrix, prioritize remediation backlog by legal risk and integration impact, and attach audit timelines to transaction milestones.

HardTechnical

45 practiced

An external audit returned medium and high findings relating to insecure configurations and missing documentation. As the Security Architect, outline a prioritized remediation and audit defense plan: triage and root-cause analysis, interim compensating controls, remediation timelines, evidence collection strategy, and how to report status to auditors and executives.

Sample Answer

**Situation & Prioritization (Triage)** - Immediately classify each finding by risk (CVSS/impact × likelihood), exposure (internet-facing, privileged systems), and compensating controls already present. - Treat High = production-facing with privileged/PII access or exploitable remotely; Medium = internal or lower-impact configurations. - Create prioritized backlog: High (0–7 days), Medium (7–30 days), Low (>30 days).

**Root-Cause Analysis** - For each finding run: configuration diff vs. baseline, recent change audit, IAM/principal mapping, and automation pipeline review. - Document RCA: misconfiguration, missing standard, process gap, or tool limitation.

**Interim Compensating Controls** - Apply rapid controls: network segmentation, ACLs, WAF rules, temporary role restrictions, MFA enforcement, and monitoring/alerting (IDS/EDR rules). - Log compensating control owner, duration, and acceptance criteria.

**Remediation Timelines & Ownership** - Define Sprints: High — hotfix + verification within 7 days; Medium — code/policy update in 2–4 sprints; Low — planned in roadmap. - Assign owners (Platform, Cloud, App teams), test plans, rollback plans, and definition of done (config in IaC, automated test, documented).

**Evidence Collection Strategy** - Record artifacts: IaC commits, config management diffs, screenshots of settings, hardened baseline templates, test results, SIEM alerts, and signed change tickets. - Store in immutable evidence repo with timestamps and link to each finding ID.

**Reporting to Auditors & Executives** - Auditors: provide traceable evidence per finding, RCA, compensating controls, and remediation tickets; invite re-scan. - Executives: concise dashboard—risk heatmap, % remediated, open high-risk with ETA, residual risk, and required decisions/resources. - Regular cadence: daily for active high findings, weekly for broader status, and a final post-remediation validation report.

**Trade-offs & Continuous Improvement** - Balance speed vs. permanence: prefer temporary controls for immediate risk, follow with permanent IaC-enforced fixes. - Update architecture standards, run automated config scans in CI/CD, and add audit-readiness playbooks to prevent recurrence.

EasyTechnical

44 practiced

Explain FedRAMP and when it applies. Describe the difference between JAB and Agency authorizations, control baselines (low/moderate/high), and the architectural considerations a cloud service provider must adopt to pursue FedRAMP authorization.

Sample Answer

**What FedRAMP is & when it applies**FedRAMP (Federal Risk and Authorization Management Program) standardizes security assessment, authorization, and continuous monitoring for cloud services used by U.S. federal agencies. It applies whenever a cloud service will host federal data or be used by an agency—authorization is required before production use.

**JAB vs Agency authorizations**- JAB (Joint Authorization Board) P-ATO: granted by the JAB (CIOs of GSA, DoD, DHS). Targeted for cloud services expected to support many agencies. Involves more rigorous review, higher visibility, and prioritizes wide reuse.- Agency ATO: an individual agency authorizes a CSP for its own use. Can be faster and tailored to agency risk tolerance; other agencies may reuse via an Agency Authorization package.

**Control baselines (NIST SP 800-53)**- Low: basic confidentiality/integrity availability impact; fewer controls.- Moderate: most federal workloads (moderate impact to citizen services); majority of controls.- High: mission-critical systems where loss has severe effects; largest control set and stricter implementations.

**Architectural considerations for a CSP pursuing FedRAMP**- Strong tenancy model: logical or physical separation as needed for data categorization.- Identity & access: centralized IAM, least privilege, MFA, role separation, privileged access management.- Network segmentation: microsegmentation, transit/inspection points, hardened gateways.- Logging & monitoring: centralized SIEM, immutable logs, retention per FedRAMP, realtime alerts for continuous monitoring.- Encryption: data-at-rest and in-transit with FIPS-validated crypto and key management separation (KMS/ HSM).- Configuration & hardening: CIS/NIST baselines, automated IaC scans, patching pipelines.- Resilience & backup: tested DR, backups encrypted and integrity-checked.- Documentation & compliance artifacts: complete SSP, System Security Plans, POA&Ms, CM documentation, and preparation for a 3PAO assessment.- Supply chain & subcontractor controls: vendor risk management and flow-down requirements.

As a Security Architect I’d map these to reference architectures, prioritize controls by baseline, and design automation for evidence collection to meet FedRAMP continuous monitoring requirements.

MediumTechnical

50 practiced

Design a vendor assessment and contract control process to evaluate third-party vendors against multiple frameworks (SOC 2, ISO 27001, PCI, GDPR). What contractual clauses, audit rights, security requirements, and ongoing monitoring would you require? Describe how to handle vendors with partial compliance or identified gaps.

Sample Answer

**Overview (purpose & scope)**Define a repeatable vendor assessment + contract-control process that maps vendor capabilities to SOC 2, ISO 27001, PCI, GDPR and enforces continuous risk reduction. I’d run this as part of onboarding, annual review, and event-driven reassessment.

**Assessment steps**- Risk-tier vendor by data sensitivity, access, and criticality.- Map required controls per framework to vendor roles (e.g., encryption at rest/in transit for PCI/GDPR; least privilege, logging for SOC2/ISO).- Collect evidence: certificates (ISO 27001), SOC 2 Type II report, PCI ROC/SAQ, DPIA results, pen test reports, AOC.- Score via a questionnaire (SIG or custom) and assign remediation priorities.

**Contractual clauses & security requirements**- Data processing agreement (GDPR) with lawful basis, purpose limitation, retention, subprocessors, and international transfer mechanisms.- Security obligations: encryption standards (TLS1.2+/AES-256), IAM (MFA, RBAC), logging/retention (90+ days), secure SDLC, vulnerability management cadence.- Compliance attestation cadence (annual SOC2/ISO recertification; PCI quarterly scans).- Breach notification: <=72 hours for security incidents; 24 hours for confirmed data exfiltration.- SLA/security KPIs: MTTD/MTTR targets, patching windows (critical CVE within 7 days).- Data location and segregation; no co-mingling of customer data.- Subprocessor flow-down and approval process.- Liability & indemnity: caps, security-specific indemnities, forensic cost coverage.- Termination & data return/destruction clauses.

**Audit & verification rights**- Right to audit: annual on-site/remote audits or via independent assessor; review raw logs and configurations under NDA.- Right to request evidence within defined SLAs (e.g., 10 business days).- Accept third-party attestations (SOC2 Type II, ISO27001) plus right to validate via complementary control testing.

**Ongoing monitoring**- Continuous telemetry: integrate vendor alerts into SIEM/SOAR where feasible.- Quarterly risk reviews and automated health checks (vulnerability scan results, cert expiration).- Use risk platform to track attestations, change notifications, and remediation tickets.- Triggered reassessment on major incidents or scope changes.

**Handling partial compliance / gaps**- Classify gaps: critical, high, medium, low. Critical = immediate access restrictions or suspension until fixed.- Define remediation plans with deadlines and owner (e.g., fix critical within 14 days, high within 60 days).- Require compensating controls where remediation delayed: e.g., additional encryption, reduced privileges, monitored access windows, proxying through company-managed gateway.- For chronic gaps, escalate to procurement/legal to restrict scope, negotiate price/indemnity, or offboard.

**Example enforcement**- Vendor lacks SOC2 Type II but provides ISO27001 + recent penetration test. Accept with compensating controls: enhanced logging, quarterly attestation, and a 90-day remediation plan for missing controls; right to audit in 30 days.

This approach balances legal enforceability, technical controls, and operational monitoring while allowing pragmatic risk-based acceptance with clear remediation and enforcement.

EasyTechnical

54 practiced

Describe the purpose of ISO/IEC 27001 and list the major control domains found in Annex A. Explain the ISMS lifecycle using the Plan-Do-Check-Act (PDCA) cycle and give one example control from at least three different Annex A domains and how it maps into PDCA.

Sample Answer

**Purpose of ISO/IEC 27001** As a Security Architect I view ISO/IEC 27001 as the international standard that defines requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). Its goal is risk-based protection of confidentiality, integrity and availability, demonstrable governance and continuous improvement to meet business and regulatory needs.

**Major Annex A control domains (high level)** - A.5 Information security policies - A.6 Organization of information security - A.7 Human resource security - A.8 Asset management - A.9 Access control - A.10 Cryptography - A.11 Physical and environmental security - A.12 Operations security - A.13 Communications security - A.14 System acquisition, development and maintenance - A.15 Supplier relationships - A.16 Information security incident management - A.17 Information security aspects of business continuity management - A.18 Compliance

**ISMS lifecycle — PDCA** - Plan: scope ISMS, perform risk assessment, select controls and create policies. - Do: implement controls, processes, training and technology. - Check: monitor, audit, measure effectiveness, management review. - Act: address nonconformities, update risk treatment, improve controls and policies.

**Examples mapping controls into PDCA** - A.9 Access control — Control: user access provisioning and review. - Plan: define roles, access policy and SOD rules. - Do: implement IAM workflows and enforce least privilege. - Check: periodic access reviews and access logs. - Act: remediate orphaned accounts, update role definitions.

- A.12 Operations security — Control: change management for systems. - Plan: define change policy and approval criteria. - Do: execute changes through controlled pipeline (CI/CD gates). - Check: verify post-change testing and monitoring. - Act: revert/patch process improvements and update runbooks.

- A.16 Incident management — Control: incident response plan and playbooks. - Plan: create IR plan, roles, escalation and communication procedures. - Do: run tabletop exercises and deploy detection tooling. - Check: post-incident reviews, KPIs (MTTR). - Act: incorporate lessons learned into controls, update playbooks.

These mappings show how Annex A controls are selected via risk in Plan, implemented in Do, validated in Check, and refined in Act — the continuous improvement loop central to ISO/IEC 27001.

Unlock Full Question Bank

Get access to hundreds of Compliance Frameworks and Certification Standards interview questions and detailed answers.

Join thousands of developers preparing for their dream job.