CISA Question 430

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  The greatest concern for an IS auditor when reviewing information security controls would be the absence of mobile device provisions in the information security policy, especially in today’s increasingly mobile and remote work environments. Here’s why: Mobile device risks: Mobile devices, such as smartphones, tablets, and laptops, represent significant security risks because they are more susceptible to being lost, stolen, or hacked. These devices can access sensitive company data and, if not properly secured, can introduce vulnerabilities. Having provisions for managing the security of mobile devices is crucial to maintaining the integrity of an organization’s information security framework. Security control gaps: If the policy does not address mobile devices, it could create a significant gap in the organization's security posture, leaving critical data exposed. This omission could lead to breaches, unauthorized access, or data loss.

• Chose D2

  While the frequency of reviewing the information security policy (option B) is important for ensuring its relevance and alignment with evolving threats and organizational changes, it is secondary to the fundamental issue of having the policy approved by the appropriate authority (option D).

• 1

  A should be the greatest concern