While preparing for an audit of information security controls in the environment, an analyst outlines a framework control that has the following requirements: All sensitive data must be classified. All sensitive data must be purged on a quarterly basis. Certificates of disposal must remain on file for at least three years. This framework control is MOST likely classified as:
A) prescriptive
B) risk-based
C) preventive
D) corrective

Question

Quizplus · Accepted Answer

The framework control is prescriptive because it specifies exact actions and requirements that must be followed, such as classifying data, purging it quarterly, and maintaining disposal certificates.

While Preparing for an Audit of Information Security Controls in the Environment