Section 5: Controlling Risk Given the following categories or areas where risk e

Section 5: Controlling Risk
Given the following categories or areas where risk exists, and then the 3 assets for each, describe how you will test for associated risk:
Administrative
Human resources: Hiring and termination practices
Organizational structure: A formal security program
Security policies: Accurate, updated, and known or used
Technical
Access control: Least privileged
System architecture: Separated network segments
System configurations: Default configurations
Physical
Heating and air conditioning: Proper cooling and humidity
Fire: Fire suppression
Flood: Data center location