How can an organization have some type evidence-based assertion that increases one's certainty that a security-related deliverable can withstand specified security threats?
A) Through Risk Analysis Matrix.
B) Through Information security assurance (ISA).
C) Through Internal Controls.
D) Through hiring hackers to test the system.

Question

Quizplus · Accepted Answer

Information security assurance (ISA) refers to the process of providing evidence-based assurance that a security-related deliverable can withstand specified security threats. This is achieved through the use of various techniques such as testing, verification, and validation. ISA helps organizations to increase their certainty that their security-related deliverables are effective in mitigating security risks.

Options A, C, and D are not the best choices for providing evidence-based assurance because:
A) Risk Analysis Matrix only helps to identify risks but does not provide evidence that security-related deliverables can withstand the identified risks.
C) Internal Controls refer to the policies and procedures in place to ensure compliance, but do not provide evidence that security-related deliverables can withstand specified security threats.
D) Hiring hackers to test the system can help identify vulnerabilities, but it does not provide evidence that the system can withstand specified security threats.

How Can an Organization Have Some Type Evidence-Based Assertion That