CISSP: Certified Information Systems Security Professional

Question

An application is used to transfer funds between an organization and a third party. During a security audit, an auditor has identified an issue with the business-continuity disaster-recovery policy and procedures for this application. Which of the following reports should the auditor file with the organization?

Explanation

A SOC 2 report addresses a service organization’s controls for the Trust Services Criteria, including security and availability. Business continuity and disaster recovery controls support availability by enabling continued operations and recovery after a disruption. SOC 1 is intended for controls relevant to financial reporting rather than general security and availability controls.

Learn more

Become a SOC-er player and win at risk management

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ217

Community Discussion