Security Auditing & Compliance Standards Flashcards

Which ISO 27001 document establishes the scope, objectives, and policies of an organization's information security management system?

Answer: Information Security Policy

The Information Security Policy sets top-level direction and commitment from management for the ISMS, defining scope and objectives.

During a compliance audit, the auditor requests evidence of patch management activities. Which artifact BEST demonstrates timely patching?

Answer: Patch deployment logs with timestamps

Patch deployment logs with timestamps provide objective evidence that patches were actually applied and within acceptable timeframes.

Which GDPR principle requires that personal data be collected for specified, explicit, and legitimate purposes?

Answer: Purpose limitation

The purpose limitation principle under GDPR requires organizations to collect data only for clearly defined, lawful purposes.

The concept of 'separation of duties' in an audit context is designed primarily to prevent:

Answer: Single-person fraud or error going undetected

Separation of duties ensures no single individual can complete a sensitive process alone, reducing the risk of undetected fraud or error.

Which framework is commonly used as a baseline for auditing IT governance and aligns IT goals with business objectives?

Answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) provides a framework for IT governance and management aligned with business goals.

A financial services firm must comply with regulations requiring retention of electronic communications for at least 7 years. This is MOST directly governed by:

Answer: SEC Rule 17a-4

SEC Rule 17a-4 governs retention requirements for electronic records in broker-dealers, including a minimum 7-year retention period for most records.

Which audit sampling method selects items based on their monetary value or risk significance, giving higher-value items a greater chance of selection?

Answer: Monetary unit sampling

Monetary unit sampling (MUS) weights selection probability by item value, focusing audit effort on higher-risk, higher-value transactions.