A metrics dashboard provides real-time, quantifiable data on network performance and availability. It allows the IS auditor or management to directly compare actual performance against defined objectives, making it the most useful tool for evaluating whether availability targets are being met.

https://www.isaca.org/resources/isaca-journal/past-issues/2014/is-audit-basicsthe-core-of-it- auditing

Ensuring users can only perform tasks and functions assigned to their roles demonstrates effective logical access controls and enforcement of the principle of least privilege, which is a core indicator that security requirements have been properly implemented in the software.

Creating a bit-level copy (also known as a forensic image) of the affected servers and calculating the hash value ensures that an exact replica of the system is preserved for forensic analysis without altering the original data. This is critical for investigating the incident, understanding what happened, and maintaining the integrity of the evidence. The hash value guarantees that the copy remains unchanged and can be used as evidence if needed.
While documenting the servers and their usage, copying directories, and even unplugging the servers could be necessary steps later, preserving the system's state through a forensic copy is the top priority to avoid data loss or contamination.

https://www.allinterview.com/showanswers/14542/major-concern-auditor-reviewing-organizations- business-process-reengineering-brp.html