CISA: Certified Information Systems AuditorDemo

Encryption on a mobile device protects sensitive data at rest by rendering it unreadable to an unauthorized person who obtains the lost device. This directly mitigates disclosure of the device’s stored corporate data.

A data-classification policy establishes the classification framework: its levels, criteria, responsibilities, and required handling rules. Data process mapping and the categorization or prioritization of data are implementation activities that follow from that governing policy.

A digital signature applies a hash function to create a message digest and encrypts or signs that digest using the sender’s private key. This supports integrity verification and signer authentication.

A bare-metal (Type 1) hypervisor runs directly on the underlying hardware, so it does not require a host operating system. It can still host guest operating systems and their applications in virtual machines.

Benchmarking surveys provide peer and industry performance data, enabling an organization to compare its IT measures with those of similar organizations.

Traditional FTP sends authentication credentials and transferred data in clear text and uses separate control and data channels, which broadens the network exposure that firewall rules must permit.

A risk assessment systematically identifies threats, vulnerabilities, likelihood, and impact associated with a proposed technology or implementation. It is therefore the appropriate activity for evaluating security risks introduced by a virtualization technique before adoption.

A steering committee provides project-level governance and represents the interests of key stakeholder groups in strategic oversight and decision-making.

Support and maintenance requirements define the supplier’s expected post-acquisition services, such as warranty coverage, repair, replacement, and ongoing technical support. Including them enables suppliers to address the full lifecycle requirements of the hardware acquisition.

Information security policies should be based primarily on a risk management process so that controls, requirements, and priorities address the organization’s specific threats, vulnerabilities, impacts, and risk appetite.

A recovery point objective (RPO) specifies the maximum acceptable amount of data loss following a disaster, typically measured as a period of time. A recovery time objective (RTO) specifies acceptable downtime, and mean time to recover (MTTR) measures the average time required for recovery. Microsoft Learn: Business continuity, high availability, and disaster recovery

Input validation is a primary control for data integrity because it prevents invalid, incomplete, improperly formatted, or unauthorized data from being accepted and subsequently written to the database. A missing validation control can directly compromise the accuracy and reliability of stored information.

Mapping data-classification controls to datasets maintains the required handling, access, protection, and governance requirements as data is transformed into derived datasets.

Performance metrics provide objective, measurable evidence of whether an IT vendor is meeting agreed service-level commitments, such as availability, response time, and resolution time.

The reporting phase includes communicating audit findings to the auditee so that the facts can be confirmed, responses can be obtained, and corrective actions can be discussed before final reporting. ISACA guidance describes reporting as including discussions, a draft report, comments from auditees, an exit conference, and issuance of the final report.

Critical security vulnerabilities should be promptly escalated to the responsible IT management so that remediation can begin immediately. Recording the issue in the audit report does not provide the necessary timely notification.

Remote hypervisor management traffic should be isolated and restricted with network- and transport-layer protections, including firewalls, segmentation, and encrypted communications such as IPsec. These controls directly reduce exposure of the hypervisor management interface to unauthorized remote access.

Performance baselines define normal operating levels for key metrics, allowing the monitoring system to identify meaningful deviations, trends, and potential service issues. Without established baselines, collected performance data cannot be evaluated effectively.

A data retention policy defines required retention periods and disposal practices for information. It supports regulatory and business obligations while preventing the ongoing cost of retaining data and storage media longer than necessary.

Directive controls establish required behavior through policies, procedures, standards, and similar instructions. Hiring requirements that ensure network administrators are qualified direct the organization to select personnel meeting specified criteria.

Audit conclusions must be supported by detailed, relevant evidence in the workpapers. Documentation of the successes and weaknesses of all contingency testing provides the underlying evidence needed to support conclusions about the corporate disaster recovery test.

Unchanged default database settings can retain known default credentials, excessive permissions, enabled services, or insecure configurations that attackers can readily exploit. This creates a more immediate and potentially critical exposure than password-expiration policy, data-retention gaps, or incomplete logging.

Reconciling total amounts by project to the spreadsheet source totals verifies that the job-costing entries agree with the calculated project costs and helps detect entry errors or omissions.

Threat and vulnerability analysis identifies potential threat events and the weaknesses they could exploit, enabling proactive identification of risk scenarios that may affect IT processes before incidents occur. Historical metrics, incident reports, self-assessments, and policy reviews are useful inputs, but are less direct methods for discovering previously unrecognized risks.