In a cybersecurity audit, broad checklist categories alone provide the detailed testing procedures and evidence requirements needed to evaluate controls.

### Why this is right The supplied material names broad checklist categories and references an external checklist resource, but it does not provide the detailed checklist items in the text. It would therefore be unsupported to claim that specific detailed items are specified here. ### The concept An audit checklist can help auditors organize review work, but its contents should reflect the audit’s objectives, scope, and applicable requirements. A heading or reference to a checklist does not establish the individual tests or evidence that belong in it. Auditors should not infer missing criteria; they need to consult the applicable checklist or define suitable tests within the agreed audit plan. ### The other options - **True**: this is incorrect because the supplied text gives broad categories as headings but does not list their detailed items. ### Terms - **Audit checklist**: A structured aid for organizing audit questions, evidence requests, or control checks. - **Audit criteria**: The requirements or expectations used to evaluate evidence and controls. ### Remember Do not treat a checklist heading or external reference as if it supplied the missing test details.