An IS auditor observes that an organization's systems are being used for cryptocurrency mining on a regular basis. Which of the following is the auditor's FIRST course of action?

The correct answer is C. Consult the organization's acceptable use policy. The auditor's first course of action should be to consult the organization's acceptable use policy (AUP) to determine whether cryptocurrency mining is permitted or violates organizational rules. This establishes a clear understanding of the organization's stance on the activity…

Submitted by rania.sa· Apr 18, 2026Information System Auditing Process

Question

An IS auditor observes that an organization’s systems are being used for cryptocurrency mining on a regular basis. Which of the following is the auditor’s FIRST course of action?

Options

AReport the incident immediately
BRecommend changing the organization's firewall settings
CConsult the organization's acceptable use policy
DRequire mining software to be uninstalled

How the community answered

(28 responses)

A
14% (4)
B
7% (2)
C
75% (21)
D
4% (1)

Explanation

The auditor's first course of action should be to consult the organization's acceptable use policy (AUP) to determine whether cryptocurrency mining is permitted or violates organizational rules. This establishes a clear understanding of the organization's stance on the activity and informs the appropriate next steps. Without reviewing the policy, it is premature to report the incident or recommend changes.

Topics

#Audit methodology#Acceptable Use Policy (AUP)#Auditor's initial steps#Policy compliance

Community Discussion

No community discussion yet for this question.

Full CISA Practice