The primary factor to determine system criticality is the maximum allowable downtime (MAD), which is the maximum period of time that a system can be unavailable before causing significant damage or risk to the organization. TheMAD reflects the business impact and the recovery requirements of the system, and it can be used to prioritize the systems and allocate the resources for disaster recovery planning. The other options are not as important as the MAD, and they may vary depending on the system characteristics and the recovery strategy. The recovery point objective (RPO) is the maximum amount of data loss that is acceptable for a system. The mean time to restore (MTTR) is the average time required to restore a system after a failure. The key performance indicators (KPIs) are metrics that measure the performance and effectiveness of a system. References: CISA Review Manual (Digital Version) 1, page 468-469.
QUESTIO NO. 704
Which of the following would provide the BEST evidence that a cloud provider's change management process is effective?
A. Minutes from regular change management meetings with the vendor
B. Written assurances from the vendor's CEO and CIO
C. The results of a third-party review provided by the vendor
D. A copy of change management policies provided by the vendor
Answer: C
The results of a third-party review provided by the vendor would provide the best evidence that a cloud provider’s change management process is effective, because it would be an independent and objective assessment of the vendor’s compliance with best practices and standards for managing changes in the cloud environment. A third-party review would also include testing of the vendor’s change management controls and procedures, and provide recommendations for improvement if needed.
Minutes from regular change management meetings with the vendor would not provide sufficient evidence, because they would only reflect the vendor’s self-reported information and may not capture all the changes that occurred or their impact on the cloud services. Written assurances from the vendor’s CEO and CIO would also not provide sufficient evidence, because they would be based on the vendor’s own opinion and may not be verified by external sources. A copy of change management policies provided by the vendor would not provide sufficient evidence, because it would only show the vendor’s intended approach to change management, but not how it is implemented or monitored in practice.
References:
ISACA Cloud Computing Audit Program, Section 4.5: Change Management
Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives, Section 4.3: Change Management
