サンプル問題 1： An organization has identified a number of components needed for an assessment. These components cover systems/applications for customers in the states of Massachusetts and Nevada. Assuming management wants corresponding regulatory factors to be included in their assessment, which regulatory factors would apply? (Select all that apply)
A: State of Massachusetts Data Protection Act
B: CMS Minimum Security Requirements (High)
C: State of Nevada Security of Personal Information Requirements
D: Texas Health and Safety Code
E: Subject to De-ID Requirements
正解：A, C
Explanation: When performing HITRUST scoping, organizations must include regulatory factors relevant to their operational and geographic context. Since this entity operates in Massachusetts and Nevada, two state-specific privacy and security laws apply: Massachusetts Data Protection Act (201 CMR 17.00): Requires businesses handling personal data of Massachusetts residents to maintain a written information security program (WISP), including encryption and monitoring controls. Nevada Security of Personal Information Law (NRS 603A): Mandates encryption for personal information stored or transmitted electronically and requires reasonable security measures. The CMS Minimum Security Requirements (High) (B) would apply only if the entity processes Medicare/Medicaid-related data. The Texas Health and Safety Code (D) applies only to Texas-based covered entities. Subject to De-ID Requirements (E) is a general data-handling condition, not a state-specific regulatory factor. Therefore, only Massachusetts Data Protection Act and Nevada Security of Personal Information Requirements apply in this scenario. Reference: HITRUST CSF Assurance Program C “Regulatory Factor Scoping”; CCSFP Study Guide C “State-Specific Regulatory Factors.”
サンプル問題 2： A pharmacy that accepts Medicare/Medicaid and also takes credit cards should include which regulatory factors in their assessment?
A: FISMA
B: FTC Red Flags Rule
C: PCI-DSS
D: FedRAMP
E: CMS (Centers for Medicare and Medicaid Services) Minimum Security Requirements (High)
正解：B, C, E
Explanation: Scoping an assessment involves identifying regulatory factors that apply to an organization’s operations. In this case, the entity is a pharmacy that accepts Medicare/Medicaid and processes credit cards. Medicare/Medicaid participation introduces obligations under CMS Minimum Security Requirements (High), which adds federal requirements specific to healthcare entities working with Centers for Medicare and Medicaid Services. Credit card acceptance triggers applicability of the Payment Card Industry Data Security Standard (PCI-DSS), a widely recognized standard for protecting cardholder data. Additionally, pharmacies often fall under the FTC Red Flags Rule, which applies to organizations that maintain consumer accounts and must protect against identity theft. By contrast, FISMA applies to federal agencies or contractors, not pharmacies, and FedRAMP applies only to cloud service providers working with the federal government. Therefore, the correct set of regulatory factors is FTC Red Flags Rule, PCI-DSS, and CMS Minimum Security Requirements (High). Reference: HITRUST CSF Assessment Methodology C “Regulatory Factors”; CCSFP Study Guide C “Mapping Healthcare and Financial Regulatory Factors.”
サンプル問題 3： When testing, can you sample across a population of ungrouped primary components within an assessment's scope?
A: Yes, across most of the components within scope
B: No, you must test all components within scope
C: Yes, across some of the components within scope
D: Yes, a primary component sample can be produced using guidance from the scoring rubric
正解：B
Explanation: HITRUST distinguishes between grouped and ungrouped components. When primary components (e.g., servers, databases, firewalls) are not grouped, they must be tested individually. This is because each ungrouped component may have unique configurations, operational practices, or control implementations, meaning sampling would not yield accurate results. Sampling is only permitted when components are grouped and proven to be functionally identical. In ungrouped situations, the assessor must test each component to validate control effectiveness. This ensures accuracy in scoring and avoids the risk of overlooking control failures in heterogeneous environments. Therefore, when components remain ungrouped, the assessor is required to test all components within scope and cannot rely on sampling methods. Reference: HITRUST CSF Assurance Program C “Component Scoping & Sampling”; CCSFP Practitioner Guide C “Ungrouped Component Testing.”
