Match each security assessment finding to its most direct operational or compliance concern: Findings: - Missing access logs - Outdated data retention policy - Developers using personal repository accounts for proprietary code - Inconsistent access control enforcement Concerns: - Impairs incident investigation and audit trail verification - Fails to reflect current regulatory standards and business practices - Weakens organizational oversight and access governance over source code - Results in inappropriate or excessive user privileges

### The pairs | Item | Matches | Why | |---|---|---| | Missing access logs | Reduced ability to monitor activity and provide audit evidence | Logs record events such as access. Their absence limits investigation and makes it harder to show what controls did. | | Outdated data-retention policy | Policy may not reflect current practices or applicable expectations | A policy needs review so that its rules remain aligned with current operations and obligations. | | Developers use personal GitHub accounts for client code | Company oversight and control of code access may be weakened | Personal accounts may sit outside company-managed access and review processes. | | Inconsistent access controls | Users may receive unequal or inappropriate permissions | Access controls determine who can use information or systems; inconsistent application can create unnecessary access. | ### The concept Assessment findings are more useful when they are connected to the risk they create. The same finding may have multiple effects, so assessors should record what is known and avoid claiming more than the evidence supports. ### Terms - **Access control**: Rules and mechanisms that determine who can use a system or information. ### Remember Describe each finding in terms of the control weakness and its likely consequence.