CCAK · Question #21
During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan). Management stated that it is responsible…
The correct answer is B. Review the security white paper of the CSP. When management asserts that the CSP has an adequate and tested DR plan, the auditor's immediate next step is to review the CSP's security white paper. The security white paper is the primary publicly available document where CSPs disclose their security architecture…
Question
During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan). Management stated that it is responsible for ensuring that the cloud service provider (CSP) has a plan that is tested annually. What should be the auditor's NEXT course of action?
Options
- AReview the CSP audit reports.
- BReview the security white paper of the CSP.
- CReview the contract and DR capability.
- DPlan an audit of the CSP.
How the community answered
(35 responses)- A11% (4)
- B77% (27)
- C6% (2)
- D6% (2)
Explanation
When management asserts that the CSP has an adequate and tested DR plan, the auditor's immediate next step is to review the CSP's security white paper. The security white paper is the primary publicly available document where CSPs disclose their security architecture, resilience capabilities, and disaster recovery provisions. This gives the auditor a baseline understanding of what the CSP claims to offer before proceeding to deeper verification steps such as reviewing contracts or SLAs. It is a low-cost, immediately accessible starting point to assess whether management's reliance on the CSP's DR capabilities is reasonable and documented.
Topics
Community Discussion
No community discussion yet for this question.