Question

A security assessor is working with an organization to review the policies and procedures associated with managing the organization's virtual infrastructure. During a review of the virtual environment, the assessor determines the organization is using servers to provide more than one primary function, which violates a regulatory requirement. The assessor reviews hardening guides and determines policy allows for this configuration.

It would be MOST appropriate for the assessor to advise the organization to:

A. segment dual-purpose systems on a hardened network segment with no external access
B. assess the risks associated with accepting non-compliance with regulatory requirements
C. update system implementation procedures to comply with regulations
D. review regulatory requirements and implement new policies on any newly provisioned servers

Answer 1

The most appropriate action for the security assessor to advise is updating system implementation procedures to comply with regulations, ensuring both current and future configurations meet the required standards.

Step-by-step explanation:

A security assessor, who is working with an organization to manage their virtual infrastructure, has determined that the organization is using servers that provide more than one primary function. This setup violates a regulatory requirement. The appropriate course of action for the assessor to advise the organization would be to update system implementation procedures to comply with regulations. Doing this ensures that all current and future configurations adhere to the necessary regulatory standards, thereby mitigating risk and aligning with compliance requirements. While segmenting dual-purpose systems and reviewing new policies for newly provisioned servers might be part of a response plan, the foremost step should be to bring existing systems into compliance with regulations.

It is critical to assess the risks associated with non-compliance; however, the immediate priority should be to address the current breach of regulatory requirements. The organization, upon the assessor's advice, should document any changes and ensure that policies are also updated to reflect these changes. This way, they can avoid potential legal or financial penalties associated with non-compliance.