CISA Question 63

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  My view is that B is the best answer. When an auditor finds that an organization is not proactively addressing known vulnerabilities, the preventive side of risk reduction (lowering likelihood) is not yet working well. The auditor’s first question should therefore be about the other side of the risk equation, which is impact: does the organization regularly test its disaster recovery plan? A tested DRP is a corrective control that can limit the damage immediately if an incident occurs, and it gives the auditor some assurance while vulnerability remediation is still catching up. Option C, assessing security risks, is less convincing as a first step. A DRP only exists after a risk assessment and business impact analysis have already been done, so the organization almost certainly has some risk assessment in place, and the question never says otherwise. Risk assessment also does not reduce risk by itself; it only prioritizes what to do next, which can follow once the auditor knows the recovery capability is sound.

• Chose C1

  The first thing is to assess risk

• Chose C3

  C. Assess the security risks to the business. When an IS audit reveals that an organization is not proactively addressing known vulnerabilities, the IS auditor should recommend that the organization assess the security risks to the business (Option C) as the first step. Understanding the potential impact of vulnerabilities on the organization's operations, data, and overall security posture is crucial. This assessment will help prioritize vulnerability remediation efforts, allocate resources effectively, and ensure that vulnerabilities are addressed in a risk-informed manner.