An external audit found the organization fully compliant with its industry regulation, yet a month later attackers exploited a weakness in a business system that the regulation does not cover and that had never been risk assessed. What does this MOST likely indicate?
Select an answer to reveal the explanation.
Short Explanation
Compliance is the minimum the rulebook asks for, not a map of everything that can hurt you. If a system fell outside the rulebook and nobody ever risk assessed it, the real gap was treating 'we passed the audit' as 'we're secure'. Don't blame the auditors for checking exactly what they were asked to check.
Full Explanation
Regulations define a baseline set of requirements for a particular scope, and audits test conformance to that baseline. They do not identify every risk an organization faces. The scenario shows a system that fell outside the regulation and was never risk assessed, which points to a governance gap in which compliance was being used as a proxy for security. Effective information security management requires an ongoing risk assessment process that covers all business-relevant assets and threats, with compliance obligations as one input. Blaming the auditors misreads their role; they assessed compliance with the regulation, and the system in question was outside that scope, so a clean result was not an audit failure. Calling for the regulation to be extended places responsibility on an external body for a risk the organization should have identified itself. Concluding that the breach was unforeseeable and nothing needs to change ignores that the system had never been assessed; the gap was in the process, not in the attacker's ingenuity. Exam caveat: compliance remains mandatory and important, but on CISM a compliant organization is not presumed secure. Operational check: reconcile the asset inventory against the risk register to confirm every business-critical system has a current risk assessment.