Encrypting the data in the database provides the most effective protection for customer records by ensuring confidentiality even if unauthorized access occurs, directly addressing the lack of data protection at rest.

https://bakkah.com/knowledge-center/it-portfolio-management

For organizations with multiple regional offices, the primary audit focus should be on processes and system dependencies. Dependencies determine recovery sequencing, resource prioritization, and interconnectivity between systems across regions.
RPO monitoring (A): Important but a subset of overall recovery planning.
Training (C): Necessary but not the first priority when evaluating plan adequacy.
Data backup/storage (D): Technical component but less comprehensive than analyzing dependencies.

This approach directly measures whether the expected financial or strategic benefits of the IT project have been achieved. By comparing the planned ROI with the actual ROI, an organization can assess if the project delivered the anticipated value, such as cost savings, efficiency improvements, or revenue growth.
While reviewing SDLC processes, evaluating compliance with security controls, and benchmarking IT project management practices are useful for evaluating project quality and governance, comparing planned versus actual ROI focuses specifically on the tangible benefits realized by the project, making it the most relevant method for evaluating project success.