Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the concepts of security, compliance, and identityMedium
A regulatory body has mandated that a healthcare organization must be able to demonstrate that all changes to patient medical records are recorded, attributed to a specific user, and timestamped. This is crucial for verifying compliance and investigating incidents. Which security concept directly addresses this requirement?
- AIntegrity
- BAvailability
- CAuditability
- DConfidentiality
Show answer & explanationAnswer & explanation
Correct answer: C. Auditability
Auditability refers to the ability to record, examine, and verify activities within a system, ensuring that actions can be traced back to individuals and provide a historical record for compliance and investigation purposes.
Why the other options are wrong
- A. Integrity focuses on preventing unauthorized modification of data, while auditability focuses on recording *who* made changes and *when*, even if authorized.
- B. Availability ensures data access but isn't about tracking who did what.
- D. Confidentiality ensures data privacy but doesn't focus on recording changes or attributing actions.
Auditability
Auditability refers to the ability to track, record, and review all actions and events within a system, ensuring that an accurate and complete historical record exists for accountability, compliance, and forensic analysis.
- Creates a verifiable trail of activities.
- Essential for compliance and incident response.
- Records who, what, when, and where.
Memory trick: Audits ensure a clear paper trail.