Power line conditioners are used to compensate for peaks and valleys in the power supply and reduce peaks in the power flow to what is needed by the machine. Any valleys are removed by power stored in the equipment. Surge protection devices protect against high-voltage bursts. Alternative power supplies are intended for computer equipment running for longer periods and are normally coupled with other devices such as an uninterruptible power supply (UPS) to compensate for the power loss until the alternate power supply becomes available. An interruptible power supply would cause the equipment to come down whenever there was a power failure.

Explanation/Reference:
Explanation:
The old access points should be discarded and replaced with products having strong security; otherwise, they will leave security holes open for attackers and thus make the entire network as weak as they are.
Affordability is not the auditor's major concern. Performance is not as important as security in this situation.
Product manageability is not the IS auditor's concern.

Section: Protection of Information Assets
Explanation:
Tampering with a badge reader cannot open the door, so this is irrelevant. Logging the entry attempts may
be of limited value. The biggest risk is from unauthorized individuals who can enter the data center,
whether they are employees or not. Thus, a process of deactivating lost or stolen badges is important. The
configuration of the system does not change frequently, therefore frequent backup is not necessary.

Explanation/Reference:
Explanation:
Information security governance, when properly implemented, should provide four basic outcomes:
strategic alignment, value delivery, risk management and performance measurement. Strategic alignment provides input for security requirements driven by enterprise requirements. Value delivery provides a standard set of security practices, i.e., baseline security following best practices or institutionalized and commoditized solutions. Risk management provides an understanding of risk exposure.

Section: Protection of Information Assets
Explanation:
Recovery time objectives (RTOs) are the acceptable time delay in availability of business operations, while recovery point objectives (RPOs) are the level of data loss/reworking an organization is willing to accept.
Mean time between failures and minimum operating requirements help in defining recovery strategies.