Which of the following storage options would give the organization the best chance of recovering data?
A.
Encrypted physical copies of the data, and their encryption keys are stored together at the organization and are readily available upon request.
B.
Encrypted physical copies of the data are stored separately from their encryption keys, and both are held in secure locations a few hours away from the organization.
C.
Encrypted reports on usage and database structure changes are stored on a cloud-based, secured database that is readily accessible.
D.
Encrypted copies of the data are stored in a separate secure location a few hours away, while the encryption keys are stored at the organization and are readilyavailable.
Data must be protected, recoverable, and accessible when needed while maintaining security.
The best practice is to store encrypted backups offsite while keeping encryption keys separate but accessible.
Why Option D is Correct?
Storing encrypted data offsite (a few hours away) ensures protection against disasters (e.g., fire, cyberattacks, physical damage).
Keeping encryption keys at the organization ensures that recovery is quick and controlled without risking unauthorized access.
This aligns with the IIA's IT Audit Practices and ISO 27001 (Information Security Management), which emphasize separate storage of encrypted data and encryption keys for security and recoverability.
IIA Standard 2110 – Governance requires internal auditors to assess whether IT governance ensures the availability and security of critical data.
Why Other Options Are Incorrect?
Option A (Encrypted physical copies and keys stored together at the organization):
If both data and keys are in the same location, a disaster or breach would make recovery impossible.
Option B (Encrypted copies and keys stored in separate locations far away):
While secure, if encryption keys are stored too far, recovery could be delayed, impacting business continuity.
Option C (Encrypted usage reports in a cloud database):
This does not ensure full data recovery; it only provides logs and structure changes, not the actual data.
Storing encrypted data offsite while keeping encryption keys accessible onsite follows best IT security and disaster recovery practices.
IIA Standard 2110 supports evaluating IT governance, including data security and recovery controls.
Final Justification:IIA References:
IPPF Standard 2110 – Governance
ISO 27001 – Information Security Management
NIST SP 800-34 – Contingency Planning Guide for IT Systems
COBIT Framework – Data Security & Recovery Controls
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit