Isaca Certified Information Systems Auditor CISA Question # 93 Topic 10 Discussion
CISA Exam Topic 10 Question 93 Discussion:
Question #: 93
Topic #: 10
An IS auditor discovers from patch logs that some in-scope systems are not compliant with the regular patching schedule. What should the auditor do NEXT?
A.
Interview IT management to clarify the current procedure.
B.
Report this finding to senior management.
C.
Review the organization ' s patch management policy.
D.
Request a plan of action to be established as a follow-up item.
The IS auditor should review the organization’s patch management policy to determine the expected frequency and scope of patching, as well as the roles and responsibilities of the patch management team. This will help the auditor assess the severity and impact of the non-compliance, and identify the root cause and possible remediation actions12.
References
1: How to Create a Patch Management Policy: Complete Guide 2: Free Patch Management Policy Template (+Examples)
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit