hardMultiple Choice
Compliance Audit: Mapping Security Controls to Regulatory Clauses
A company's compliance officer wants to ensure that the organization's security controls meet regulatory requirements for data protection. The officer requests a review of the controls against the regulation's specific clauses. Which type of assessment is most appropriate?
Quick Answer
The answer is a compliance audit because it is the only assessment type that directly maps security controls to specific regulatory clauses, such as GDPR Article 32 or HIPAA Security Rule §164.312, to verify adherence to legal requirements. Unlike a risk assessment, which identifies and prioritizes threats based on likelihood and impact, or a vulnerability assessment, which scans for technical weaknesses, a compliance audit uses structured checklists and evidence collection to confirm that each control satisfies a mandated clause. On the CISSP exam, this distinction tests your understanding of the Governance and Risk Management domain, where the common trap is confusing a risk assessment’s broader scope with the precise, clause-by-clause verification of a compliance audit. Remember the mnemonic “CAR” for Compliance Audit = Regulatory mapping, Risk assessment = Threat prioritization, Vulnerability scan = Technical gaps.
⚠ Common exam trap
It's easy for candidates to confuse a compliance audit with a risk assessment, as both involve reviewing controls, but only the audit measures adherence to specific regulatory clauses rather than prioritizing risks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliance audit
A compliance audit is the correct assessment type because it systematically evaluates security controls against specific regulatory clauses (e.g., GDPR Article 32, HIPAA Security Rule §164.312). Unlike risk or vulnerability assessments, a compliance audit maps controls directly to legal requirements to verify adherence, often using checklists and evidence collection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk assessment
Why it's wrong here
Risk assessment ranks threats and likelihood against business impact; it does not compare controls with regulation clauses. It is tempting because compliance gaps are risks, and it would be correct when prioritising remediation or determining whether residual risk is acceptable.
- ✗
Vulnerability assessment
Why it's wrong here
Vulnerability assessment scans systems for known weaknesses; it does not map controls to regulatory clauses. It is tempting because it produces evidence auditors use, and would be correct when the goal is finding exploitable technical flaws rather than demonstrating clause-by-clause compliance.
- ✗
Penetration test
Why it's wrong here
A penetration test simulates attacks to find exploitable vulnerabilities; it does not map controls to specific regulatory clauses. It is tempting because it demonstrates security assurance, but clause-by-clause conformity against a regulation requires a compliance or controls assessment, not offensive testing.
- ✓
Compliance audit
Why this is correct
A compliance audit maps implemented controls directly against each regulatory clause, producing evidence of conformity or gaps. This clause-by-clause verification is precisely what the compliance officer requests, distinguishing it from a risk assessment or penetration test, which evaluate exposure rather than regulatory alignment.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to verify that its security policies are being followed by employees. Which testing method is most appropriate?
medium- ✓ A.Compliance audit
- B.Vulnerability scan
- C.Risk assessment
- D.Penetration test
Why A: A compliance audit is the most appropriate method to verify that security policies are being followed because it systematically compares actual practices, configurations, and controls against documented policy requirements. Unlike technical scans that identify vulnerabilities, a compliance audit focuses on adherence to rules, standards, and procedures, often using checklists derived from frameworks like ISO 27001 or NIST SP 800-53.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.