2 cissp ® Official Study Guide Eighth Edition

Understand how to maintain accountability.
Accountability is maintained for individual 
subjects through the use of auditing. Logs record user activities and users can be held 
accountable for their logged actions. This directly promotes good user behavior and com-
pliance with the organization’s security policy.
Understand the importance of security audits and reviews.
Security audits and reviews 
help ensure that management programs are effective and being followed. They are com-
monly associated with account management practices to prevent violations with least 
privilege or need-to-know principles. However, they can also be performed to oversee patch 
management, vulnerability management, change management, and configuration manage-
ment programs.

---

Written Lab 
795
Understand auditing and the need for frequent security audits.
Auditing is a methodical 
examination or review of an environment to ensure compliance with regulations and to 
detect abnormalities, unauthorized occurrences, or outright crimes. Secure IT environ-
ments rely heavily on auditing. Overall, auditing serves as a primary type of detective 
control used within a secure environment. The frequency of an IT infrastructure security 
audit or security review is based on risk. An organization determines whether sufficient risk 
exists to warrant the expense and interruption of a security audit. The degree of risk also 
affects how often an audit is performed. It is important to clearly define and adhere to the 
frequency of audit reviews.
Understand that auditing is an aspect of due care.
Security audits and effectiveness 
reviews are key elements in displaying due care. Senior management must enforce compli-
ance with regular periodic security reviews, or they will likely be held accountable and 
liable for any asset losses that occur.