CISA · Question #306
An IS auditor is reviewing how password resets are performed for users working remotely. Which type of documentation should be requested to understand the detailed steps required for this activity?
The correct answer is C. Procedures. Procedures provide the detailed, step-by-step instructions for how a specific task is to be performed - exactly what an auditor needs to understand the exact steps for remote password resets. Policies (B) state high-level management intent and rules ('passwords must be reset when
Question
An IS auditor is reviewing how password resets are performed for users working remotely. Which type of documentation should be requested to understand the detailed steps required for this activity?
Options
- AGuidelines
- BPolicies
- CProcedures
- DStandards
How the community answered
(22 responses)- A5% (1)
- C86% (19)
- D9% (2)
Explanation
Procedures provide the detailed, step-by-step instructions for how a specific task is to be performed - exactly what an auditor needs to understand the exact steps for remote password resets. Policies (B) state high-level management intent and rules ('passwords must be reset when compromised') but not how to execute the task. Standards (D) define specific measurable requirements (e.g., password complexity rules). Guidelines (A) offer non-mandatory recommendations. Only procedures document the precise operational steps.
Topics
Community Discussion
No community discussion yet for this question.