IT Auditing - Information Security Control

Question 1

Preventative control

Answer 1

Exists to prevent the threat from coming in contact with the weakness.

They are firewalls

Question 2

Compensating controls

Answer 2

Alternate controls as designed to accomplish the intent of the original controls as closely as possible. When original designed controls cannot be used due to limitations.

Question 3

Detective Controls

Answer 3

IDS is purely detective

Acts as a motion sensor

Question 4

NIST Framework

Answer 4

Used in execution of information security/Cybersecurity compliance audit

Question 5

ISO

Answer 5

Is a European Framework; replaces of COSO/COBIT

Question 6

Questions for IT financial assessment

Answer 6

1) How are IT costs allocated, monitored and controlled?
2) What is the current and forecasted OPEX/CAPEX level?
3) In what areas does the target plan to invest going forward?
4) How has OPEX/CAPEX developed over time?
5) Are there any planned decommissioning of legacy technology leading to cost savings?
6) What are the planned investments to replace existing technology?

Question 7

Data sources

Answer 7

1) Interviews with CIO and CFO.
2) Internal documentation: IT spending.
3) External market research, e.g. benchmark against industry peers.