Assessing Corporate Cybersecurityintermediate
Explain the primary purpose of collecting and recording evidence during an assessment, and identify two valid types of evidence that assessors gather.
Answer
The primary purpose of collecting and recording evidence is to substantiate findings and recommendations, ensuring they are traceable, verifiable, and objective rather than based on unsupported opinion. Two valid types of evidence are documentary evidence (e.g., operational records, policies, logs) and testimonial or observational evidence (e.g., interview statements, physical inspections of equipment or facilities).
Explanation
### The concept
Assessment evidence is information gathered to support findings. It can be documentary, such as a record that was examined, or observational, such as a description of equipment. Interview notes capture who was consulted and what they said. Recording evidence helps explain why a finding was made and gives the organization a basis for reviewing recommendations.
### What a good answer covers
- Evidence supports findings rather than leaving them as unsupported opinions.
- Interview records can include respondents’ names and statements.
- Documentary evidence can include record identifiers and contents.
- Observations can describe facilities or equipment that assessors checked.
### Terms
- **Finding**: an assessment conclusion based on reviewed information.
### Remember
A recommendation is more useful when the evidence behind it can be traced.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free