Question

During a governance review, an IS auditor finds that the organization's information security policies were last approved five years ago. Since then, the company has adopted cloud services, a remote-work model, and is now subject to new data protection regulations. Management states the policies are still 'technically valid.' What should the auditor conclude is the MOST significant governance weakness?

Accepted Answer

There is no defined process to periodically review and update policies to reflect changes in the business, technology, and regulatory environment

Answer

The policies were not distributed to all new remote employees

Answer

The security policies do not reference the specific cloud vendor's controls

Answer

The policies were approved by management rather than the board of directors