During an information security audit, it was determined that IT staff did not follow the established standard when configuring and managing IT systems. Which of the following is the BEST way to prevent future occurrences?
A.
Providing annual information security awareness training
A strict change control process (C) is the most effective preventive measure because it embeds compliance with standards into the system lifecycle and operational workflow. If staff are deviating from configuration/management standards, the core issue is often lack of enforced process controls: undocumented changes, rushed fixes, inconsistent approvals, or missing validation. Formal change management ensures changes are requested, risk-assessed, approved by authorized parties, tested, implemented, and reviewed, with traceability and accountability. Annual awareness training (A) helps general understanding but is weaker than a control that prevents and detects unauthorized deviations. Vulnerability scanning (B) is detective and may identify weaknesses after the fact, but it does not ensure standards are followed. Updating configuration baselines (D) is valuable, but without change control, baselines can still be bypassed. In CISM program management, the best answer typically emphasizes repeatable, auditable processes that reduce human error and enforce governance.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit