CISM · Question #859
Which of the following MOST effectively identifies the organization's ability to comply with legal, regulatory, and contractual requirements?
The correct answer is D. Gap analysis. A gap analysis directly compares the organization's current controls, policies, and practices against specific legal, regulatory, and contractual requirements to identify where deficiencies exist. It is structured specifically to answer 'where do we fall short of what is…
Question
Which of the following MOST effectively identifies the organization's ability to comply with legal, regulatory, and contractual requirements?
Options
- AControl self-assessment (CSA)
- BVulnerability scan
- CRisk assessment
- DGap analysis
How the community answered
(25 responses)- A16% (4)
- B8% (2)
- C4% (1)
- D72% (18)
Explanation
A gap analysis directly compares the organization's current controls, policies, and practices against specific legal, regulatory, and contractual requirements to identify where deficiencies exist. It is structured specifically to answer 'where do we fall short of what is required?' A control self-assessment (CSA) evaluates control effectiveness broadly but is not focused on external requirements. A vulnerability scan identifies technical weaknesses, not compliance posture. A risk assessment evaluates threats and potential impact but does not map the organization's state against specific compliance mandates the way a gap analysis does.
Topics
Community Discussion
No community discussion yet for this question.