Exam CISA topic 1 question 21 discussion

The IS auditor does not define classification levels (Option D) or directly secure the assets (Option A). Ensuring regulatory alignment (Option C) may be a part of the audit scope, but it is not the primary focus in the context of classification.

Answer: B

regulatory is the keyword for me

Primary role is to define

Primary role is to validate

The main function of the IS (Information Systems) auditor in an organization's information classification process is to ensure that information assets are protected according to the assigned classification. Therefore, the correct option is B. The IS auditor is in charge of evaluating and verifying that adequate security measures are implemented to protect the organization's information assets in accordance with their classification. This involves reviewing existing policies and controls, as well as testing and auditing to ensure assets are effectively protected. While the other options may be additional functions of the IS auditor in relation to the classification of information, the primary function is to ensure that assets are adequately protected based on their assigned classification.

La función principal del auditor de SI (Sistemas de Información) en el proceso de clasificación de la información de una organización es asegurar que los activos de información estén protegidos según la clasificación asignada. Por lo tanto, la opción correcta es la B. El auditor de SI se encarga de evaluar y verificar que se implementen las medidas de seguridad adecuadas para proteger los activos de información de la organización de acuerdo con su clasificación. Esto implica revisar las políticas y controles existentes, así como realizar pruebas y auditorías para asegurarse de que los activos estén protegidos de manera efectiva. Si bien las otras opciones pueden ser funciones adicionales del auditor de SI en relación con la clasificación de la información, la función principal es garantizar que los activos estén protegidos adecuadamente según su clasificación asignada.

I thought B is better answer than C

The IS auditor plays a crucial role in ensuring that an organization's information classification process aligns with regulatory guidelines and industry best practices. They are responsible for assessing the effectiveness and appropriateness of the classification levels assigned to information assets within the organization.

The assigned classification may also contain regulatory requirements, so answer B is correct.

Why the answer is not C?