Section: Information System Operations, Maintenance and Support

It is important that the data entered from a remote site is edited and validated prior to transmission to the central processing site.

Section: Protection of Information Assets
Explanation:
Cost performance of a project cannot be properly assessed in isolation of schedule performance. Cost
cannot be assessed simply in terms of elapsed time on a project. To properly assess the project budget
position, it is necessary to know how much progress has actually been made and, given this, what level of
expenditure would be expected. It is possible that project expenditure appears to be low because actual
progress has been slow. Until the analysis of project against schedule has been completed, it is impossible
to know whether there is any reason to reduce budget, if the project has slipped behind schedule, then not
only may there be no spare budget but it is possible that extra expenditure may be needed to retrieve the
slippage. The low expenditure could actually be representative of a situation where the project is likely to
miss deadlines rather than potentially come in ahead of time. If the project is found to be ahead of budget
after adjusting for actual progress, this is not necessarily a good outcome because it points to flaws in the
original budgeting process; and, as said above, until further analysis is undertaken, it cannot be determined
whether any spare funds actually exist. Further, if the project is behind schedule, then adding scope may
be the wrong thing to do.

Explanation
The security architecture of an online application is a design that describes how various security components and controls are integrated and configured to protect the application from internal and external threats. When auditing the security architecture of an online application, an IS auditor should first review the location of the firewall within the network, as this determines how effectively the firewall can filter and monitor the traffic between different network segments and zones. The firewall standards, configuration, and firmware version are also important aspects to review, but they are secondary to the location of the firewall.

Section: Protection of Information Assets
Explanation:
End-user involvement is critical during the business impact assessment phase of business continuity planning.