Section: Protection of Information Assets
Explanation:
Only encryption of the data with a secure key will prevent the loss of confidential information. In such a
case, confidential information can be accessed only with knowledge of the owner's private key, which
should never be shared. Choices B, C and D deal with authentication and not with confidentiality of
information. An individual can remove the hard drive from the secured laptop and install it on an unsecured
computer, gaining access to the data.

Section: The process of Auditing Information System

Of the choices, the hardware and access control software is generally irrelevant as long as the functionality, availability and security can be affected, which are specific contractual obligations. Similarly, the development methodology should be ofno real concern. The contract must, however, specify who owns the intellectual property (i.e., information being processed, application programs). Ownership of intellectual property will have a significant cost and is a key aspect to be defined in an outsourcing contract.