Which statement best describes IT general controls in cybersecurity auditing?

• A. They are optional and not necessary for assessing cybersecurity
• B. They include a broad set of controls such as access controls, change management, configuration management, backup and recovery, and IT operations; and should be evaluated for design and operating effectiveness
• C. They only cover physical security
• D. They are solely the responsibility of IT operations, not internal audit

Answer: (B)