Assessing Corporate Cybersecurityintermediate
Match each assurance method to the description provided.
Answer
Certification - Attestation of compliance, generally based on an external audit, Testing and evaluation - Checks implementation or effectiveness at a point in time, Review - Usually an internal examination of how consistently a standard is applied, Audit - Assessment by an assessor independent of day-to-day implementation
Explanation
### The pairs
| Item | Matches | Why |
|---|---|---|
| Certification | Attestation of compliance, generally based on an external audit | Certification represents an attestation that an enterprise, service, or system conforms to stated standards. |
| Testing and evaluation | Checks implementation or effectiveness at a point in time | Tests provide evidence about whether requirements or controls are implemented and achieve their objectives. |
| Review | Usually an internal examination of how consistently a standard is applied | Reviews consider how the standard and its processes operate over time. |
| Audit | Assessment by an assessor independent of day-to-day implementation | Independence helps avoid having implementers assess their own work without separation. |
### The concept
These assurance methods answer related but different questions. A test checks status or effectiveness; a review or audit examines consistent application over time. Certification is an attestation of compliance and may rely on an independent audit.
### Terms
- **Attestation**: a formal statement that a condition or requirement has been met.
- **Independent assessor**: an evaluator separated from the day-to-day work being assessed.
### Remember
Testing checks a point in time; reviews and audits examine application over time; certification attests to compliance.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free