Understanding Data Recovery and Security Risks:
Data must be protected, recoverable, and accessible when needed while maintaining security.
The best practice is to store encrypted backups offsite while keeping encryption keys separate but accessible.
Why Option D is Correct?
Storing encrypted data offsite (a few hours away) ensures protection against disasters (e.g., fire, cyberattacks, physical damage).
Keeping encryption keys at the organization ensures that recovery is quick and controlled without risking unauthorized access.
This aligns with the IIA's IT Audit Practices and ISO 27001 (Information Security Management), which emphasize separate storage of encrypted data and encryption keys for security and recoverability.
IIA Standard 2110 – Governance requires internal auditors to assess whether IT governance ensures the availability and security of critical data.
Why Other Options Are Incorrect?
Option A (Encrypted physical copies and keys stored together at the organization):
If both data and keys are in the same location, a disaster or breach would make recovery impossible.
Option B (Encrypted copies and keys stored in separate locations far away):
While secure, if encryption keys are stored too far, recovery could be delayed, impacting business continuity.
Option C (Encrypted usage reports in a cloud database):
This does not ensure full data recovery; it only provides logs and structure changes, not the actual data.
Storing encrypted data offsite while keeping encryption keys accessible onsite follows best IT security and disaster recovery practices.
IIA Standard 2110 supports evaluating IT governance, including data security and recovery controls.
Final Justification:IIA References:
IPPF Standard 2110 – Governance
ISO 27001 – Information Security Management
NIST SP 800-34 – Contingency Planning Guide for IT Systems
COBIT Framework – Data Security & Recovery Controls
