The role of control depth in assessment quality
...dig deeper. It's not enough to ask whether regular backups are taken and stored offsite. You have to ask how often. You have to ask where the tapes are stored before being transported offsite (hint: "under the receptionist's desk" isn't going to cut it). You have to ask whether backup tapes are encrypted. You have to ask whether backups are...
