Isaca Certified Information Systems Auditor CISA Question # 306 Topic 31 Discussion
CISA Exam Topic 31 Question 306 Discussion:
Question #: 306
Topic #: 31
An IS auditor discovers from patch logs that some in-scope systems are not compliant with the regular patching schedule. What should the auditor do NEXT?
A.
Interview IT management to clarify the current procedure.
B.
Report this finding to senior management.
C.
Review the organization ' s patch management policy.
D.
Request a plan of action to be established as a follow-up item.
The IS auditor should review the organization’s patch management policy to determine the expected frequency and scope of patching, as well as the roles and responsibilities of the patch management team. This will help the auditor assess the severity and impact of the non-compliance, and identify the root cause and possible remediation actions12.
References
1: How to Create a Patch Management Policy: Complete Guide 2: Free Patch Management Policy Template (+Examples)
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit