ISC2 CISSP (Certified Information Systems Security Professional)Security Assessment and TestingMedium
A financial institution is undergoing an annual security audit. The auditor requests evidence of the organization's policies, procedures, and training records related to data handling and access control. This request primarily focuses on which type of security process data?
- AForensic Security Data
- BAdministrative Security Data
- CTechnical Security Data
- DOperational Security Data
Show answer & explanationAnswer & explanation
Correct answer: B. Administrative Security Data
Administrative security data refers to documented policies, procedures, standards, and guidelines, as well as training records, that govern security practices within an organization. The auditor's request directly aligns with these types of documents.
Why the other options are wrong
- A. Forensic security data is collected during incident response for investigation.
- C. Technical security data includes logs, configuration files, and system outputs.
- D. Operational security data relates to day-to-day security activities and events.
Administrative Security Data
Information related to an organization's policies, procedures, standards, guidelines, and training programs that dictate how security is managed and implemented.
- Includes policies, procedures, and standards
- Covers security awareness and training records
- Forms the governance framework for security
Memory trick: Data: Admin for rules, Tech for gear, Ops for daily grind.