XYZ Network Solutions provides network services and value$-$add communications to customers in several countries in Europe and North America.

The corporate headquarters is in Miami Florida with offices in Chicago, U$.$S$.$A$.,$ London, UK and Frankfurt, Germany. The company has a sales division with eight employees led by Andre Wisser, human resources with three employees led by Jane Aubin, Technical and Communications with $45$ employees led by Peter O$$Day$.$ Finance is led by Andrea Worth but most of the Payroll and Finance functions have been outsourced to a SaaS Cloud Provider.

During peer review it would be important to ensure that the answers provided are thorough and address the wide range of issues associated with access control.

Project Title

Andrea Worth, Manager, Finance has just asked you to monitor the activity of an employee in her department. As a security professional what must you consider before doing this monitoring?

An employee that does a lot of travelling has been approving their own expenses. What control should be in place to address the risk associated with such a practice?

What class of fire is based on the burning of common combustibles such as wood and paper?

Why should a security awareness program address the risk of social engineering?

XYZ Network Solutions has contractual agreements $($Service Level Agreements$)$ with its customers and regulatory requirements that require it to maintain certain levels of network and service availability. How should these factors be addressed in the risk assessment? Should this be calculated as an quantitative or qualitative risk assessment?

What is the purpose of the RTO and RPO?

When deciding on an IT recovery strategy what considerations should be made on whether to use a commercial hot site or internal hot site $($mirror or multiple processing centers?