What is the BEST way to identify noncompliance with password policies?

The correct answer is C. Internal audit assessment. An internal audit assessment is the best way to identify noncompliance with password policies because it involves reviewing system configurations, user practices, and policy enforcement to ensure compliance. Audits provide objective and systematic evaluations, helping…

Submitted by eva_at· Apr 18, 2026Information Security Program Development and Management

Question

Options

ASecurity awareness training
BBusiness impact analysis (BIA)
CInternal audit assessment
DVulnerability scan reports

How the community answered

(30 responses)

A
7% (2)
B
13% (4)
C
77% (23)
D
3% (1)

Explanation

An internal audit assessment is the best way to identify noncompliance with password policies because it involves reviewing system configurations, user practices, and policy enforcement to ensure compliance. Audits provide objective and systematic evaluations, helping organizations detect and address security gaps. While security training, BIAs, and vulnerability scans are valuable, they do not directly assess policy adherence like an internal audit does.

Topics

#Password policies#Compliance assessment#Internal audit#Security program evaluation

Community Discussion

No community discussion yet for this question.

Full CISM Practice