A city CISO asks the internal security and audit teams to design ongoing tests of IAM and network controls that the organization itself will execute under city authority. What are they primarily building?
Select an answer to reveal the explanation.
Short Explanation
When your own audit and security folks plan the exams you will give yourselves—under the city's own roof and rules—that is an internal assessment strategy. Outside attestations and bug bounties are different animals.
Full Explanation
An internal assessment, test, and audit strategy defines how the organization’s own security and audit teams plan, scope, schedule, and execute ongoing tests of controls—here IAM and network controls—under city authority. Leadership asking those in-house teams to design tests they themselves will run is building that internal strategy: owned cadence, methods, evidence standards, and remediation tracking without pretending an outside attestation has occurred.
A PCI QSA attestation that replaces all internal testing forever confuses a possible external engagement with continuous internal assurance; QSAs do not retire the need for city-owned testing. A red-team contract with no rules of engagement is external adversarial testing without governance, not an internal strategy, and uncontrolled testing can harm production citizen services. A public bug-bounty page as the only validation method crowdsources some discovery but does not constitute a complete internal assessment program covering IAM and network control design.
Exam caveat: Domain 6 distinguishes internal versus external versus third-party attestation strategies—match the actor and the authority in the stem. Operational check: publish an annual internal test calendar for IAM and network controls, assign owners, retain evidence for audit, and show how findings enter the municipal risk register.