セクション：情報資産の保護
説明: IS スタッフが業務を遂行している様子を観察することで、IS 監査担当者は、彼らが
互換性のない操作を実行すること、およびISスタッフへのインタビューにより、監査人は概要を把握することができます。
実行されたタスク。監査人は、観察とインタビューに基づいて、分離を評価できます。
職務。経営陣は、IS部門の各従業員の詳細な職務内容を把握していない可能性がある。
したがって、経営陣との話し合いでは分離に関する限られた情報しか得られないだろう。
職務。組織図では従業員の職務の詳細が示されません。ユーザーテスト
権利はISシステム内での権利に関する情報を提供するが、
それらが果たす機能に関する完全な情報。

Explanation
The greatest concern for an IS auditor when evaluating an organization's IT strategy and plans is that IT is not engaged in business strategic planning, as this indicates a lack of alignment between IT and business objectives, which could result in inefficient and ineffective use of IT resources and capabilities. The absence of a defined IT security policy, the nondistribution of business strategy meeting minutes, and the inadequate documentation of IT strategic planning are also issues that should be addressed by an IS auditor, but they are not as significant as IT's noninvolvement in business strategic planning. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.1

Evidence collection is the process of identifying, acquiring, preserving, and documenting digital evidence from various sources, such as computers, networks, mobile devices, or cloud services, that can be used to support the investigation and prosecution of cybercrimes. Evidence collection is an IS auditor's primary focus when evaluating the response process for cybercrimes, because it determines the quality and validity of the evidence that can be used to prove or disprove the facts of the case, identify the perpetrators, and recover the losses. Evidence collection should follow the standards and best practices for digital forensics, such as ISO
/IEC 270371, which provide guidelines for ensuring the integrity, authenticity, reliability, and admissibility of the evidence2.
The other possible options are:
* A. Communication with law enforcement: This is the process of reporting, cooperating, and coordinating with law enforcement agencies that have the jurisdiction and authority to investigate and prosecute cybercrimes. Communication with law enforcement is an important aspect of the response process for cybercrimes, but it is not an IS auditor's primary focus when evaluating it. Communication with law enforcement depends on the legal and regulatory requirements, the nature and severity of the incident, and the organizational policies and procedures. Communication with law enforcement should be done after evidence collection, to avoid compromising or contaminating the evidence3.
* B. Notification to regulators: This is the process of informing and updating the relevant regulatory bodies or authorities that oversee or supervise the organization's activities or industry sector about the cybercrime incident. Notification to regulators is an important aspect of the response process for cybercrimes, but it is not an IS auditor's primary focus when evaluating it. Notification to regulators depends on the legal and regulatory requirements, the nature and impact of the incident, and the organizational policies and procedures. Notification to regulators should be doneafter evidence collection, to avoid disclosing sensitiveor confidential information4.
* C. Root cause analysis: This is the process of identifying and analyzing the underlying factors or causes that led to or contributed to the cybercrime incident. Root cause analysis is an important aspect of the response process for cybercrimes, but it is not an IS auditor's primary focus when evaluating it. Root cause analysis helps to prevent or mitigate future incidents, improve security controls and processes, and learn from mistakes. Root cause analysis should be done after evidence collection, to avoid interfering with or affecting theinvestigation5.

無線TLSからインターネットSSLへのプロトコル変換ゲートウェイとして機能するWAPゲートウェイは、メッセージの機密性を確保する制御を監査およびテストする際に、IS監査担当者が特に注意を払い、確認すべきコンポーネントです。

説明
ゼロデイ攻撃は検出が非常に困難な場合が多い。マルウェア対策ソフトウェアや一部の侵入検知システム（IDS）、侵入防御システム（IPS）は、攻撃シグネチャがまだ存在しないため、効果を発揮しないことが多い。そのため、ゼロデイ攻撃を検出する最善の方法は、ユーザー行動分析である。