ギャップ分析は、組織の新しい規制へのコンプライアンスの現状と、望ましいコンプライアンスの状態を比較するプロセスです。対処が必要なギャップや欠陥を特定し、それらを解消するためのアクションの優先順位付けに役立ちます。ギャップ分析を実行することは、新しい規制の影響を理解し、適切なリスク対応を計画するための最初のステップです。
参考文献
*ISACA CRISC レビューマニュアル、第 7 版、ドメイン 2: IT リスク評価、セクション 2.2.3: ギャップ分析
*規制の変更: デジタル時代のリスクの未来 | Deloitte US
*ギャップ分析: ギャップ分析とは何か、そしてその実行方法 | ブループリント

is incorrect. Service level monitoring can only identify operational issues in the
enterprise's operational environment. It does not play any role in ensuring that outsourced service
provider comply with the enterprise's information security policy.

is incorrect. Including the verbal change request circumvents the project's change control system. Answer: D is incorrect. You may want to report Jane to the project sponsor, but you are not obligated to include the verbal change request. Answer: B is incorrect. Directing the project team to include the change request if they have time is not a valid option. The project manager and the project team will have all of the project team already accounted for so there is no extra time for undocumented, unapproved change requests.

Internet of Things (IoT) is an emerging technology that refers to the network of devices, such as cameras, sensors, appliances, or vehicles, that can communicate and exchange data via the internet. IoT is frequently used for botnet distributed denial of service (DDoS) attacks, which are cyberattacks that aim to disrupt or disable a target's online services by overwhelming them with traffic from multiple sources. IoT devices are often unsecured, unpatched, or misconfigured, which makes them vulnerable to being infected by malware and controlled by attackers. Attackers can use IoT devices to create large and powerful botnets that can launch DDoS attacks against various targets, such as websites, servers, or networks. According to the CRISC Review Manual 2022, IoT is one of the key emerging technologies that pose new IT risks, including DDoS attacks1.
According to the CRISC Review Questions, Answers & Explanations Manual 2022, IoT is the correct answer to this question2. According to the web search results, IoT devices are commonly used for botnet DDoS attacks, such as the Mirai botnet, the Emotet botnet, and the BoT-IoT dataset345.