An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code.
What is the auditor's BEST recommendation for the organization?
Click on the arrows to vote for the correct answer
A. B. C. D.D.
The BEST recommendation for the organization, in this case, would be to undertake an analysis to determine the business risk. Option D is the correct answer.
Explanation:
When a vendor goes out of business, it can create serious problems for the organization that relies on its products or services. In this scenario, an IS auditor has found that the vendor has gone out of business and the escrow has an older version of the source code. This means that the organization may not be able to obtain support or updates for the application.
Option A: Continuing to use the existing application may not be a viable option since the application may not meet the organization's current requirements, and the lack of support and updates could expose the organization to various security and operational risks.
Option B: Preparing a maintenance plan that will support the application using the existing code may be a viable option, but it would not address the issue of the outdated source code in the escrow, and it may not be a long-term solution.
Option C: Bringing the escrow version up to date is a viable option, but it may not be possible if the vendor has gone out of business, and the organization does not have access to the updated source code.
Option D: Undertaking an analysis to determine the business risk is the BEST recommendation for the organization. This analysis should include an assessment of the impact of the outdated source code on the organization's operations, security, and compliance. Based on the analysis, the organization can develop a risk management plan that may include options such as seeking alternative vendors, developing a new application, or implementing compensating controls to mitigate the risks associated with the outdated source code.
In conclusion, the best recommendation for the organization is to undertake an analysis to determine the business risk associated with the outdated source code in the escrow.