When an IS auditor is reviewing an organization's method to transport sensitive data between offices, the greatest concern should be the use of a single method of protection, such as public key infrastructure (PKI), exclusively. While PKI is a useful and secure method of transmitting sensitive information, relying solely on this method can make the organization vulnerable to security threats if the system is compromised or if the encryption is broken. A comprehensive security program should include multiple layers of protection, such as firewalls, intrusion detection systems, and encryption, to ensure the confidentiality, integrity, and availability of sensitive information.
Reference:
ISACA. (2021). 2021 CISA Review Manual, 27th Edition. ISACA. (Chapter 3, Security Management Practices)