Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
The access control matrix is the best indicator of the level of compliance with the service level agreement (SLA) data confidentiality clauses. Encryption strength, authentication mechanism and data repository might be defined in the SLA but are not confidentiality compliance indicators.

Data and information required for penetration are shared with the testers, thus eliminating time that would otherwise have been spent on reconnaissance and gathering of information. Blind (black box) penetration testing is closer to real life than full disclosure (white box) testing. There is no evidence to support that human intervention is not required for this type of test. A full disclosure (white box) methodology requires the knowledge of the subject being tested.

Section: INFORMATION RISK MANAGEMENT
Explanation:
Organizational requirements should determine when a risk has been reduced to an acceptable level.
Information systems and information security should not make the ultimate determination. Since each organization is unique, international standards of best practice do not represent the best solution.