Auditing CIS

Which of the following does an IS auditor consider the MOST relevant to short-term planning for an IT department?

• Allocating resources

• Adapting to changing technologies

• Conducting control self-assessments

• Evaluating hardware needs

An organization has contracted with a vendor for a turnkey solution for their electronic toll collection

system (ETCS). The vendor has provided its proprietary application software as part of the solution. The contract should require that:

• A backup server is available to run ETCS operations with up-to-date data.

• A backup server is loaded with all relevant software and data.

• The systems staff of the organization is trained to handle any event.

• Source code of the ETCS application is placed in escrow.

When reviewing the IT strategy, an IS auditor can BEST assess whether the strategy supports the

organizations' business objectives by determining whether IT:

• Has all the personnel and equipment it needs.

• Plans are consistent with management strategy.

• Uses its equipment and personnel efficiently and effectively.

• Has sufficient excess capacity to respond to changing directions.

An IS audit department is planning to minimize the risk of short-term employees. Activities contributing to this objective are documented procedures, knowledge sharing, cross-training and:

• Succession planning.

• Staff job evaluation.

• Responsibilities definitions.

• Employee award programs.

The rate of change in technology increases the importance of:

• Outsourcing the IT function.

• Implementing and enforcing sound processes.

• Hiring qualified personnel.

• Meeting user requirement.

While reviewing the IT governance processes of an organization, an IS auditor discovers the firm has recently implemented an IT balanced scorecard (BSC). The implementation is complete; however, the IS auditor notices that performance indicators are not objectively measurable. What is the PRIMARY risk presented by this situation?

• Key performance indicators are not reported to management and management cannot determine the effectiveness of the BSC.

• IT projects could suffer from cost overruns.

• Misleading indications of IT performance may be presented to management.

• IT service level agreements may not be accurate.

Which of the following should be included in an organization's information security policy?

• A list of key IT resources to be secured

• The basis for access control authorization

• Identity of sensitive security assets

• Relevant software security features

Which of the following is MOST critical for the successful implementation and maintenance of a security policy?

• Assimilation of the framework and intent of a written security policy by all appropriate parties

• Management support and approval for the implementation and maintenance of a security policy

• Enforcement of security rules by providing punitive actions for any violation of security rules

• Stringent implementation, monitoring and enforcing of rules by the security officer through access control software

A comprehensive and effective email policy should address the issues of email structure, policy enforcement, monitoring and:

• recovery

• retention

• rebuilding

• reuse

The initial step in establishing an information security program is the:

• Development and implementation of an information security standards manual

• Performance of a comprehensive security control review by the IS auditor

• Adoption of a corporate information security policy statement

• Purchase of security access control software