Which of the following would be of concern to an IS auditor reviewing development practices for sensitive proprietary code?

Question

Options

• ADeveloper workstations do not have internet access.
• BDeveloper performance is not measured based on lines of code written.
• CDevelopers are debugging by uploading the code into a publicly available generative AI tool.
• DDevelopers are not using generative AI tools to maximize efficiency.

• A
  5% (1)
• B
  10% (2)
• C
  85% (17)

Explanation

Uploading sensitive proprietary code into a publicly available generative AI tool (C) is a serious concern because it can expose confidential intellectual property to third-party systems, which may store, process, or use that data in ways outside the organization's control. This represents a data leakage risk and potential violation of confidentiality obligations. Option A (no internet access on developer workstations) is actually a good security control for protecting sensitive code environments, not a concern. Option B (not measuring performance by lines of code) is a sound management practice, as such metrics are counterproductive. Option D (not using generative AI tools) is a business efficiency observation, not a security concern. The risk in option C is clear and immediate: proprietary code sent to a public AI service could be retained, exposed, or inadvertently disclosed.

No community discussion yet for this question.