Match each compliance framework to its primary focus.
Drag a concept onto its matching description — or click a concept then click the description.
Information security management system
Cybersecurity risk management framework
Payment card data security
Healthcare data privacy and security
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
HIPAA: Protects patient health information
The correct matches align each framework with its primary regulatory focus. Common confusions occur between security-focused frameworks like PCI DSS and privacy-focused ones like HIPAA, or between data protection (GDPR) and financial reporting (SOX).
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
HIPAA: Protects patient health information
Why this is correct
HIPAA (Health Insurance Portability and Accountability Act) focuses on protecting the privacy and security of patients' health information.
HIPAA: Secures credit card transactions
Why it's wrong here
Incorrect — securing credit card transactions is the focus of PCI DSS, not HIPAA.
GDPR: Protects personal data of EU residents
Why this is correct
GDPR (General Data Protection Regulation) governs the processing of personal data of individuals within the European Union.
GDPR: Ensures accuracy of financial reports
Why it's wrong here
Incorrect — ensuring accuracy of financial reports is the focus of SOX, not GDPR.
PCI DSS: Secures credit card transactions
Why this is correct
PCI DSS (Payment Card Industry Data Security Standard) sets requirements for securing credit card data and transactions.
SOX: Ensures accuracy of financial reports
Why this is correct
SOX (Sarbanes-Oxley Act) mandates accurate financial reporting and internal controls for publicly traded companies.
Go deeper
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.