In the security program lifecycle, which step involves comparing current security performance against expectations to identify gaps?

In the security program lifecycle, which step involves comparing current security performance against expectations to identify gaps?

• A. Audit
• B. Design controls
• C. Implement
• D. Monitor

Answer: (A)

Auditing is the step that formally evaluates whether actual security performance aligns with the defined expectations, policies, and requirements. It gathers evidence from monitoring activities and control testing, then compares results to targets to determine if objectives are met. By identifying gaps, weaknesses, and areas needing remediation, an audit provides the findings that drive improvements in the security program. Monitoring, while continuous and data-driven, focuses on ongoing observation and alerting rather than a formal, gap-centered assessment. Designing controls is about creating safeguards, and implementing is about putting them in place; neither is primarily about comparing performance to expectations to spot deficiencies.

Auditing is the step that formally evaluates whether actual security performance aligns with the defined expectations, policies, and requirements. It gathers evidence from monitoring activities and control testing, then compares results to targets to determine if objectives are met. By identifying gaps, weaknesses, and areas needing remediation, an audit provides the findings that drive improvements in the security program.

Monitoring, while continuous and data-driven, focuses on ongoing observation and alerting rather than a formal, gap-centered assessment. Designing controls is about creating safeguards, and implementing is about putting them in place; neither is primarily about comparing performance to expectations to spot deficiencies.