@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix schema: <https://schema.org/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

<https://knobit.org/id/task/dsec-access-design/I4> a edu:Question ;
    rdfs:label "I4 (1.5 points)"@en ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    owl:sameAs <https://bitbucket.org/reffa/ontology/id/task/dsec-access-design/I4> ;
    schema:hasPart <https://knobit.org/id/register/data-security#SE-364>,
        <https://knobit.org/id/register/data-security#SE-365>,
        <https://knobit.org/id/register/data-security#SE-366> ;
    schema:identifier "I4" ;
    schema:position 6 ;
    schema:text "Security risk framing, 0.5 each. (a) Every finding separates the vulnerability (the weakness in the design) from the threat (who or what could exploit it) and rates the risk; at least the masking, SoD and agency findings do so correctly - not the same sentence in both fields. (b) The sources are classified by kind: SRC-1 and SRC-3 EU regulations, SRC-7 an EU directive binding the bank through the Estonian act transposing it, these three published in EUR-Lex; SRC-2 a national act published in Riigi Teataja; SRC-4 supervisory guidance; SRC-5 a contractual standard; SRC-6 internal policy. One slip tolerated. (c) Every open question goes to the role whose decision it is - business need to the data owner (Head of Collections, Head of Cards), special-category and personal-data questions to the DPO, security standards and privileged or emergency access to the CISO, contract terms to the Vendor Manager - and none goes to IT for a business decision."@en .

edu:Question rdfs:label "Question"@en,
        "Küsimus"@et .

<https://knobit.org/id/register/data-security#SE-364> rdfs:label "dsec-access-design I4: vulnerability, threat and risk told apart per finding"@en .

<https://knobit.org/id/register/data-security#SE-365> rdfs:label "dsec-access-design I4: requirement sources classified by kind and place of publication"@en .

<https://knobit.org/id/register/data-security#SE-366> rdfs:label "dsec-access-design I4: open questions sent to the role that decides them"@en .