Which of the following be of GREATEST concern to an IS auditor reviewing on-site preventive maintenance for an organization’s business-critical…

The greatest concern for an IS auditor is the significant risk to data confidentiality. Business-critical servers process and store an organization's most sensitive information. Granting multiple third-party vendors physical access to this hardware without the legal safeguard of a nondisclosure agreement (NDA) creates a major control gap. This exposes the organization to a high risk of unauthorized disclosure of proprietary data, intellectual property theft, or regulatory noncompliance. An auditor's primary focus is on the effectiveness of controls to mitigate significant risks, and the lack of contractual confidentiality requirements with third parties who have physical access to critical assets represents a severe security and governance failure.

A. Budget overruns are a financial management issue, but they pose a less immediate and severe risk to information assets than a potential confidentiality breach.

B. A lack of formal approval is a procedural weakness, but the direct risk of data exposure from vendors without NDAs is a more critical and tangible threat.

D. Using Mean Time Between Failures (MTBF) to schedule maintenance is a recognized best practice for proactive hardware management, not a concern.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 4.6

"Managing Third-party Services." This section emphasizes that contracts with third-party service providers must clearly define security

confidentiality

and privacy requirements to protect the organization's information assets. The absence of an NDA is a direct failure of this control objective.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. APO10

"Managed Vendors." Management practice APO10.04

"Periodically review vendor performance and relationships and manage vendor risk

" includes ensuring that contractual protections

such as confidentiality agreements

are in place and effectively managed throughout the vendor relationship.

3. Hall

J. A. (2018). Information Technology Auditing (4th ed.). Cengage Learning. Chapter 12