Question

A newly hired risk analyst is reviewing the enterprise's document library and notices that a departmental password procedure requires a minimum of 8 characters, while the corporate information security standard mandates a minimum of 14 characters. Both documents are current and approved. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Escalate the inconsistency and require the departmental procedure to be revised to comply with the higher-level standard

Answer

Update the corporate standard to align with the more practical 8-character departmental procedure

Answer

Allow both requirements to coexist since procedures can be customized by each department

Answer

Report the department to internal audit for a control violation and recommend disciplinary action