What constitutes sufficient and appropriate evidence in cybersecurity audit engagements?

• A. Sufficient quantity and relevance from multiple sources
• B. A single interview
• C. A snapshot of configurations
• D. Vague observations

Answer: (A)

In cybersecurity audits, evidence must be enough in quantity and directly relevant to the audit objectives, and it should come from multiple, independent sources so findings can be corroborated. This broad, triangulated approach makes conclusions reliable rather than based on a single perspective. A single interview may capture only one person’s view and bias, a snapshot of configurations reveals only a moment in time and may miss changes or how controls function under different conditions, and vague observations lack verifiable detail. By gathering diverse, pertinent evidence—such as configurations, logs, test results, policy documents, and corroborating interviews—and linking them to the audit objectives, you build a defendable, well-supported conclusion about the cybersecurity controls and risk posture.