Defined (level 3) is the lowest level at which an IT balanced scorecard is defined.

Explanation/Reference:
Explanation:
If the answers provided to an IS auditor's questions are not confirmed by documented procedures or job descriptions, the IS auditor should expand the scope of testing the controls and include additional substantive tests. There is no evidence that whatever controls might exist are either inadequate or adequate. Placing greater reliance on previous audits or suspending the audit are inappropriate actions as they provide no current knowledge of the adequacy of the existing controls.

By digitally signing all e-mail messages, the receiver will be able to validate the authenticity of the sender. Encrypting all e-mail messages would ensure that only the intended recipient will be able to open the message; however, it would not ensure the authenticity of the sender. Compressing all e-mail messages would reduce the size of the message, but would not ensure the authenticity.
Password protecting all e-mail messages would ensure that only those who have the password would be able toopen the message; however, it would not ensure the authenticity of the sender.

Section: Protection of Information Assets
Explanation:
Only encryption of the data with a secure key will prevent the loss of confidential information. In such a
case, confidential information can be accessed only with knowledge of the owner's private key, which
should never be shared. Choices B, C and D deal with authentication and not with confidentiality of
information. An individual can remove the hard drive from the secured laptop and install it on an unsecured
computer, gaining access to the data.