In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place’’?

In the ROC Repotting Template, which of the following is the best approach for a response where the requirement was in Place’’?
A . Details of the entity s project plan for implementing the requirement
B . Details of how the assessor observed the entity s systems were compliant with the requirement
C . Details of the entity s reason for not implementing the requirement
D . Details of how the assessor observed the entity s systems were not compliant with the requirement

View Answer

Answer: B

Explanation:

when a cryptographic key is retired and replaced with a new key, the assessor will verify that the assessor observed the entity’s systems were compliant with the requirement, which means they should have implemented compensating controls to address any weaknesses or gaps in the customized control. This is one of the requirements for ensuring that an entity can use both approaches when appropriate.