When auditing an organization's implementation of Zero Trust principles within its identity and access management (IAM) framework, which of the following is MOST important to review for alignment?

Question

Options

• AInformation security policies
• BThe organization's core business capabilities
• CThe annual IT assurance universe
• DUser account management processes

• A
  77% (36)
• B
  9% (4)
• C
  2% (1)
• D
  13% (6)

Explanation

Information security policies are the authoritative governance artifacts that define an organization's intended security posture, including how Zero Trust principles - such as "never trust, always verify" and least-privilege access - should be implemented across IAM. Auditing against these policies establishes the formal standard for what "alignment" actually means; without them, there is no benchmark to evaluate compliance against.

Option B (core business capabilities) is irrelevant to a Zero Trust audit - business capabilities describe what the organization does, not how it secures identities and access. Option C (annual IT assurance universe) is an audit planning scope document, not a security standard; it tells you what to audit, not how to assess alignment. Option D (user account management processes) is too narrow - processes are one operational component of IAM, but policies sit above processes and govern them; reviewing only processes skips the governance layer that defines whether those processes are designed correctly in the first place.

Memory tip: Think "Policies define the rules; processes follow them." In any alignment audit, you always start with the policies, because they are the written standard against which everything else is measured - you can't evaluate alignment without first knowing what you're aligning to.

No community discussion yet for this question.