CAS-003 · Question #953
A software development company recently implemented a new policy and control ruleset. The control ruleset defines the following: - Account naming standards - Password complexity standards - SOLC…
The correct answer is C. Document the non-compliant applications and track compliance activities and progress. When mission-critical production applications are found to be non-compliant, immediately removing them (B) would cause unacceptable operational disruption. Retroactively weakening the policy to match the non-compliant state (A) defeats the purpose of the policy. Blocking all…
Question
A software development company recently implemented a new policy and control ruleset. The control ruleset defines the following:
- Account naming standards
- Password complexity standards
- SOLC practices
- Encryption baselines and standards
A review of the current applications used and developed by the company shows many production and mission-critical applications are not compliant with the new policies and control ruleset. Which of the following actions should be performed''
Options
- APerform a review of the new policies and control ruleset, and update it to reflect the current
- BRemove the non-compliant applications from the production environment until they are compliant
- CDocument the non-compliant applications and track compliance activities and progress
- DPrevent application code changes from being promoted to the production environment until the
How the community answered
(33 responses)- A15% (5)
- B3% (1)
- C76% (25)
- D6% (2)
Explanation
When mission-critical production applications are found to be non-compliant, immediately removing them (B) would cause unacceptable operational disruption. Retroactively weakening the policy to match the non-compliant state (A) defeats the purpose of the policy. Blocking all code changes until compliance is achieved (D) could freeze development indefinitely. The correct, pragmatic approach is to document all non-compliant applications, assign owners, set remediation timelines, and track progress - this creates accountability, demonstrates due diligence, and allows the organization to move toward compliance without halting operations. This is a standard risk acceptance and remediation tracking practice in governance frameworks.
Topics
Community Discussion
No community discussion yet for this question.