CISA · Question #378
An IS auditor discovers that a large number of vendor-supplied patches have not been applied to a business-critical application. What should the auditor do NEXT?
The correct answer is A. Inquire of management regarding the patching process. The next step an IS auditor should take is to inquire of management regarding the patching process. This helps understand why the patches were not applied and whether there are any legitimate reasons (such as compatibility issues, testing requirements, or resource constraints) fo
Question
An IS auditor discovers that a large number of vendor-supplied patches have not been applied to a business-critical application. What should the auditor do NEXT?
Options
- AInquire of management regarding the patching process
- BDetermine whether the application has been highly customized
- CPerform vulnerability testing on the application
- DRecommend the system owner stop using the application unit it is patched
How the community answered
(25 responses)- A80% (20)
- B8% (2)
- C8% (2)
- D4% (1)
Explanation
The next step an IS auditor should take is to inquire of management regarding the patching process. This helps understand why the patches were not applied and whether there are any legitimate reasons (such as compatibility issues, testing requirements, or resource constraints) for not applying them. This inquiry provides context before deciding on further actions like vulnerability testing or making specific recommendations.
Topics
Community Discussion
No community discussion yet for this question.