An organization has recently implemented multiple Internet of Things (IoT) devices to measure and monitor its industrial equipment. Which of the following should be the GREATEST concern for an IS…

Question

Options

• ADevice firmware has not been updated in some devices
• BThe implementation was performed by an external vendor
• CVulnerability assessments on the devices have not been completed
• DThe operational risk team has not been fully trained on IoT

• A
  9% (3)
• B
  31% (10)
• C
  44% (14)
• D
  16% (5)

Explanation

Vulnerability assessments are the foundation of any security program - without them, the organization has no visibility into what risks actually exist across its IoT attack surface, making it impossible to prioritize or remediate threats. Outdated firmware (A) is a specific, known vulnerability, but it's a finding that a vulnerability assessment would uncover; it's concerning but narrower in scope. External vendor implementation (B) is a governance and due diligence matter worth noting, but it doesn't inherently mean the implementation is insecure. Lack of operational risk training (D) is an operational concern, not a security control gap - teams can be trained after deployment without leaving systems exposed. The key IS audit principle here is "you can't manage what you can't measure": without a vulnerability assessment, the organization is flying blind on risk.

Memory tip: Think of vulnerability assessments as the map - firmware updates, vendor reviews, and training are all destinations on that map, but without the map itself, you don't know where the dangers are. An IS auditor always looks for whether risk has been identified before asking whether it's been addressed.

No community discussion yet for this question.