Exam CISM topic 1 question 531 discussion

Where segregation of duties cannot be implemented to deter and prevent malicious actions due to budgetary constraints, monitoring is best way which allows deterrence and detection. Monitoring is more proactive than documenting. User provisioning is not the only security concern wrt this arrangement.

D. Implement monitoring of IT administrator activities: This is the most appropriate initial step in this scenario. By monitoring IT administrator activities, the security manager can gain insights into how the responsibilities are being managed and whether there are any security risks or conflicts of interest in these roles. It allows the manager to identify any potential issues and develop a more comprehensive plan for addressing them.

D. Implement monitoring of IT administrator activities.

The BEST course of action for the information security manager in this scenario is to implement monitoring of IT administrator activities.