A municipal hybrid estate runs voter-registration data in a cloud SaaS tenant and legacy case files in an on-premises data center. What should an enterprise security audit scope include?
Select an answer to reveal the explanation.
Short Explanation
Hybrid city stacks hide risk in two places at once — the cloud dials and the basement racks. A real audit looks at both the cloud control plane and on-prem protections for the case files. Printers and cafeteria POS alone miss the estate you actually care about.
Full Explanation
Audits spanning on-premises, cloud, and hybrid locations must include the control planes, identity configurations, and facility or host controls wherever sensitive data and processing live. Excluding cloud identity and configuration because a provider exists leaves a major portion of risk unexamined. Narrow non-representative scopes fail to give management a complete assurance picture.