Information Technology and Data Security
IT general controls
Access management, change management, backup and recovery, and IT operations form the backbone. Candidates should understand that general controls support application controls-if access is poorly controlled, application-level approvals are unreliable. Traps ask whether a finding is a general or application control.
Access and identity
Least privilege, segregation of duties, periodic access reviews, and privileged access management. A frequent trap: assuming a terminated employee's access is removed automatically; the control is timely deprovisioning, tested by sampling.
Change management
Changes should be authorized, tested, approved, and segregated from production. Emergency changes require retrospective review. Questions often describe a developer pushing code to production-a clear segregation failure.
Cybersecurity and data protection
Know defense in depth, encryption in transit and at rest, multi-factor authentication, and incident response. Data privacy obligations include safeguarding customer information and breach notification. Traps confuse authentication (who you are) with authorization (what you may do).
Resilience
Business continuity and disaster recovery plans must be tested, not merely documented. Recovery time objectives and recovery point objectives differ: RTO is how fast you restore; RPO is how much data you can afford to lose.
Worked example
A vendor hosts customer data with no MFA and no tested recovery plan. Rule of thumb: third-party risk is your risk-request SOC reports, test the recovery plan, and require MFA as a contractual control.