CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingHard
A large pharmaceutical company is developing a new drug. The project involves significant regulatory compliance requirements, including strict data integrity and auditability of all research and development (R&D) data. The company implements a blockchain-based ledger for tracking all experimental results and changes, ensuring an immutable and verifiable record. This control is primarily designed to achieve which of the following control objectives?
- AAvailability
- BIntegrity
- CNon-repudiation
- DConfidentiality
Show answer & explanationAnswer & explanation
Correct answer: B. Integrity
The primary purpose of a blockchain's immutability and verifiable record is to ensure that data has not been altered or corrupted, directly addressing the control objective of integrity. While it contributes to non-repudiation by linking actions to identities, the core function described (tracking results and changes, ensuring verifiable records) directly underpins data integrity.
Why the other options are wrong
- A. Availability ensures data and systems are accessible when needed, which is not the core benefit described.
- C. Non-repudiation ensures that a party cannot deny having performed an action. While a blockchain can support non-repudiation, the question specifically emphasizes 'data integrity and auditability of all R&D data' and 'immutable and verifiable record' for 'experimental results and changes', which points more strongly to integrity as the primary objective over non-repudiation, which is often a secondary benefit derived from the integrity of the record.
- D. Confidentiality protects data from unauthorized disclosure, which is not the primary function of an immutable ledger described here.
Control Objective: Integrity
Ensuring the accuracy, completeness, and validity of data and information, and protecting it from unauthorized modification.
- Data remains unaltered and correct.
- Prevents unauthorized changes.
- Supports auditability and trustworthiness.
Memory trick: CIA+N: Confidentiality, Integrity, Availability, Non-repudiation.