Question 91

Explanation

Correct Answer: A. Storage media recycling policy. Explanation: Among the given options, the storage media recycling policy would provide the IS auditor with the GREATEST assurance that data disposal controls support business strategic objectives. Here's why: 1. Alignment with strategic objectives: A storage media recycling policy outlines the organization's approach to disposing of storage media, such as hard drives, tapes, or solid-state drives. By having a specific policy in place for media recycling, the organization demonstrates its commitment to properly disposing of sensitive data and aligning with strategic objectives related to data privacy, security, and environmental sustainability. 2. Compliance with legal and regulatory requirements: A storage media recycling policy ensures that the organization follows applicable laws and regulations governing data disposal. By adhering to these requirements, the organization mitigates legal and compliance risks and aligns its data disposal practices with the strategic objective of maintaining a compliant operating environment. 3. Protection against data breaches: Proper disposal of storage media is crucial to prevent unauthorized access to sensitive information. The storage media recycling policy outlines procedures for securely erasing or destroying data on media before recycling or disposal. This helps protect against data breaches and supports the strategic objective of maintaining data confidentiality and integrity. 4. Environmental sustainability: In today's business landscape, environmental sustainability is an important strategic objective for many organizations. A storage media recycling policy ensures that obsolete or non-functional media are disposed of in an environmentally responsible manner, such as through recycling or proper e-waste disposal. This demonstrates the organization's commitment to sustainability and aligns with strategic objectives related to corporate social responsibility. Options B, C, and D are not the BEST choices for providing assurance that data disposal controls support business strategic objectives: - Option B, a data retention policy, focuses on determining how long data should be retained based on legal, regulatory, and business requirements. While important for managing data lifecycle, it does not directly address the disposal of data and may not provide the same level of assurance as a storage media recycling policy. - Option C, data backup and recovery procedures, deals with the processes and measures for creating backups of data and restoring it in case of data loss or system failures. While important for data availability and business continuity, it does not specifically address data disposal controls and their alignment with strategic objectives. - Option D, an access control policy, defines the rules and restrictions for accessing and using organizational resources. While vital for maintaining data security, it does not directly focus on data disposal controls and their alignment with strategic objectives. Therefore, the correct answer is A. Storage media recycling policy. Having a comprehensive policy specifically addressing the disposal of storage media provides the IS auditor with the greatest assurance that data disposal controls support the organization's business strategic objectives.