During an information security audit, an auditor discovers that the current disaster recovery plan was developed three years ago but never tested. There have been significant changes to information systems since the plan was developed. The auditor should:

Question

Quizplus · Accepted Answer

The auditor should recommend that management and users update and test the recovery plan to ensure it reflects current systems and processes, as it has not been tested and there have been significant changes since its development.

During an Information Security Audit, an Auditor Discovers That the Current