A security log is a record of security-related events or activities that occur in an IT system, network, or application, such as user authentication, access control, firewall activity, or intrusion detection1. Security logs can help to monitor and audit the security posture and performance of the IT environment, and to detect and investigate any security incidents, breaches, or anomalies2.
The integrity of a security log refers to the accuracy and completeness of the log data, and the assurance that the log data has not been modified, deleted, or tampered with by unauthorized or malicious parties3. The integrity of a security log is essential for ensuring the reliability and validity of the log analysis and reporting, and for providing evidence and accountability for security incidents and compliance4.
Among the four options given, the most important factor to the integrity of a security log is the inability to edit. This means that the security log data should be protected from any unauthorized or accidental changes or alterations, such as adding, deleting, or modifying log entries, or changing the log format or timestamps5. The inability to edit can be achieved by implementing various controls and measures, such as:
* Applying digital signatures or hashes to the log data to verify its authenticity and integrity
* Encrypting the log data to prevent unauthorized access or disclosure
* Implementing least privilege access to the log data to restrict who can view, modify, or delete the log data
* Using write-once media or devices to store the log data, such as CD-ROMs or WORM drives
* Sending the log data to a secure and centralized log server or repository, and using syslog or other protocols to ensure secure and reliable log transmission
* Performing regular backups and archiving of the log data to prevent data loss or corruption References = Security Log: Best Practices for Logging and Management, Security Audit Logging Guideline, Confidentiality, Integrity, & Availability: Basics of Information Security, Steps for preserving the integrity of log data, Guide to Computer Security Log Management

The next step after determining that a key control does not meet design expectations is to document the finding in the risk register, because this helps to record and track the information about the identified risk, such as its description, likelihood, impact, response, and status. A key control is a control that addresses a significant risk or supports a critical business process or objective. A control design expectation is a criterion or requirement that defines how the control should operate or perform to achieve its objective. If a key control does not meet its design expectation, it means that there is a gap, weakness, or deficiency in the control that may compromise its effectiveness or efficiency, and increase the risk exposure or impact. By documenting the finding in the risk register, the risk practitioner can communicate and report the risk issue to the relevant stakeholders, such as the risk owner, the management, or the auditor, and initiate the appropriate risk response actions, such as modifying the design of the control, implementing a compensating control, or accepting the risk. The other options are not the best next steps after determining that a key control does not meet design expectations. Invoking the incident response plan is a reactive measure that is triggered when a risk event occurs or is imminent, and requires immediate action to contain, mitigate, or recover from the incident.
However, in this case, the risk event has not occurred yet, and there may be time to prevent or reduce it by improving the control design. Re-evaluating key risk indicators is a monitoring activity that measures and evaluates the level and impact of risks, and provides timely signals that something may be going wrong or needs urgent attention. However, in this case, the risk practitioner has already identified the risk issue, and needs to document and address it, rather than re-evaluate it. Modifying the design of the control is a possible risk response action that may be taken to improve the control and reduce the risk, but it is not the next step after determining that the key control does not meet design expectations. The next step is to document the finding in the risk register, and then decide on the best risk response action, which may or may not be modifying the design of the control, depending on the cost-benefit analysis, the risk assessment, and the risk response strategy. References = Risk IT Framework, ISACA, 2022, p. 13

Section: Volume D

Section: Volume B
Explanation/Reference:
Explanation:
The Identified risks and potential responses are documented in the risk register. A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:
* A description of the risk
* The impact should this event actually occur
* The probability of its occurrence
* Risk Score (the multiplication of Probability and Impact)
* A summary of the planned response should the event occur
* A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event)
* Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.
Incorrect Answers:
B: This is not a valid choice for this question
C: The project management plan is the parent of the risk management plan, but the best choice is the risk register.
D: The risk management plan is an input to the risk response planning, but it is not the best choice for this question