Monitoring systems rely heavily on thresholds to detect anomalies or incidents. If thresholds can be changed without proper change management controls, the entire system's reliability is compromised because unauthorized or improper changes could either suppress critical alerts or generate excessive false positives.
While senior management review (A) is important for governance, it does not directly affect the accuracy of monitoring results. Periodic threshold updates (B) are actually good practice as long as they are controlled.
Third-party configuration (D) can be acceptable if properly governed. ISACA's COBIT BAI06 (Managed IT Changes) stresses that all changes to production systems-including monitoring thresholds-must follow formal change control processes to maintain integrity and reliability.
References (ISACA): COBIT 2019, BAI06 Managed IT Changes.

Explanation
Information security policies are high-level statements that define the organization's approach to protecting its information assets from threats and risks. They should be based primarily on a risk management process, which is a systematic method of identifying, analyzing, evaluating, treating, and monitoring information security risks. A risk management process can help ensure that the policies are aligned with the organization's risk appetite, business objectives, legal and regulatory requirements, and stakeholder expectations. An information security framework is a set of standards, guidelines, and best practices that provide a structure for implementing information security policies. It can support the risk management process, but it is not the primary basis for defining the policies. Past information security incidents and industry best practices can also provide valuable inputs for defining the policies, but they are not sufficient to address the organization's specific context and needs. References: Insights and Expertise, CISA Review Manual (Digital Version)

Explanation/Reference:
Explanation:
All suggested items should be considered by the system owner before agreeing to penetration tests, but the most important task is to be able to restore all systems to their original state.
Information that is created and/or stored on the tested systems should be removed from these systems. If for some reason, at the end of the penetration test, this is not possible, all files (with their location) should be identified in the technical report so that the client's technical staff will be able to remove these after the report has been received.

Explanation
Admin accounts typically have the highest level of privileges and access to sensitive data. If the passwords for these accounts are not set to expire, it increases the risk of unauthorized access and potential security breaches. This is especially true if an admin's credentials are compromised, as the attacker could have ongoing access to critical systems and data1.
References:
Database Auditing - Satori