A security analyst has been informed that the development team has plans to develop an
application which does not meet the company’s password policy. Which of the following should be
done NEXT?
A.
Contact the Chief Information Officer and ask them to change the company password policy so
that the application is made compliant.
B.
Tell the application development manager to code the application to adhere to the company’s
password policy.
C.
Ask the application development manager to submit a risk acceptance memo so that the issue
can be documented.
D.
Inform the Chief Information Officer of non-adherence to the security policy so that the
developers can be reprimanded.