Certified Information Systems Auditor (CISA) — Question 195

When removing a financial application system from production, which of the following is MOST important?

Answer options

• A. Media used by the retired system has been sanitized.
• B. Software license agreements are retained.
• C. End-user requests for changes are recorded and tracked.
• D. Data retained for regulatory purposes can be retrieved.

Correct answer: D

Explanation

The correct answer is D because retaining data for regulatory purposes is essential for compliance and audits. Options A, B, and C, while important, do not take precedence over the necessity to ensure that regulatory data is accessible after the system is taken out of production.