What should an IS auditor ensure when a financial organization intends to utilize production data in the testing environment?

The correct answer is A. The data utilized is de-identified. When production data is used in non‑production environments, masking or anonymizing it is essential to protect sensitive customer and financial information. De‑identification mitigates privacy and regulatory risks while preserving data utility for testing.

Submitted by stefanr· Apr 18, 2026Protection of Information Assets

Question

Options

AThe data utilized is de-identified
BThe data utilized is accurate
CThe data utilized is complete
DThe data utilized is current

How the community answered

(55 responses)

A
71% (39)
B
7% (4)
C
18% (10)
D
4% (2)

Explanation

When production data is used in non‑production environments, masking or anonymizing it is essential to protect sensitive customer and financial information. De‑identification mitigates privacy and regulatory risks while preserving data utility for testing.

Topics

#Data privacy#Data security#Test data management#De-identification

Community Discussion

No community discussion yet for this question.

Full CISA Practice