Exam CISA topic 1 question 37 discussion

BCP is key, incase of any risk

c for charlie

A. Mobile devices are not encrypted: This is the greatest concern because unencrypted mobile devices pose a significant risk to data security. If these devices are lost or stolen, sensitive data stored on them could be easily accessed by unauthorized individuals, leading to potential data breaches.

Must be C

Answer: D While updating the BCP is essential for long-term resilience, addressing the lack of user training is more critical in the short term to mitigate immediate risks associated with the new system implementation. Therefore, the IS auditor's greatest concern would likely be the absence of user training.

not encrypting is sin

Given the change in where data is stored, we need to reconsider how we respond to emergencies.

While all the findings mentioned are important considerations for the organization's security and compliance posture, the lack of encryption on mobile devices poses the most significant risk. With the implementation of a cloud document storage solution and the removal of the ability for users to save data locally, there's a heightened reliance on mobile devices for accessing and storing data. If these devices are not encrypted, sensitive information stored on them could be at risk of unauthorized access or exposure in the event of loss or theft