CS Professional · Internal and Forensic Audit · Cyber Forensics
A forensic auditor reviewing Gomti Pharma Ltd asks what the law treats as 'reasonable security practices and procedures' when the company has no agreement with the affected party and no specific law applies. Which statement matches the Information Technology Act, 2000?
Where there is no agreement and no other law, reasonable security practices are those prescribed by the Central Government in consultation with professional bodies or associations it considers fit. This is the fallback in the Explanation to Section 43A, not the company's own judgment.
- AOnly practices the company's own board decides are reasonable
- BPractices prescribed by the Central Government in consultation with such professional bodies or associations as it deems fitCorrect
- CPractices set by the Indian Computer Emergency Response Team under Section 70B on a case-by-case basis
- DPractices that the intermediary chooses after being called upon by a monitoring agency
Explanation
The Explanation to Section 43A says reasonable security practices are those specified in an agreement or any law; in the absence of both, they are those prescribed by the Central Government in consultation with professional bodies or associations it deems fit. The board's own view or CERT-In case-by-case decisions are not the stated fallback.
Did you get it right without looking?
One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.
More Cyber Forensics questions
- Ravi, an outsider with no authorisation, knowingly accesses a government database restricted for reasons of the security of the State and ob…
- During a suspected data-theft inquiry at an Indian firm, a forensic auditor must examine a seized laptop's hard disk. Which step should be t…
- A forensic auditor reviews an incident at Bharat Grid Ltd where an outsider, intending to threaten the security of India, introduced a compu…
- During a forensic review, an auditor examines a log that records the origin, destination, route, time, size and duration of communications b…
- An auditor investigating a suspected intrusion into the servers of a Chennai firm must capture data that disappears when power is lost, such…
- A forensic auditor at a Delhi bank finds that an insider copied customer files to a USB drive and then deleted them from the workstation. Wh…