Question

During a review of IT operations, an IS auditor finds that the configuration management database (CMDB) is used to support incident, problem, and change management processes. However, several recent outages were traced to changes made on servers that were not reflected in the CMDB. What should the auditor recommend as the MOST effective control to address this issue?

Accepted Answer

Perform periodic automated discovery reconciliation between the CMDB and the actual production environment

Answer

Increase the frequency of full backups of the CMDB repository

Answer

Require all users to attend annual configuration management awareness training

Answer

Restrict CMDB read access to the change advisory board members only