What determines the frequency of reviewing logs for all other system components?

• A. Regulatory deadlines.
• B. Budget constraints.
• C. Organizational governance.
• D. Organization's policies and risk management strategy.

Answer: (D)

The frequency for reviewing logs across all system components is set by the organization’s policies and risk management strategy. These define the expected cadence for monitoring based on asset criticality, risk level, and control requirements, so the review rhythm aligns with how the organization manages risk. Regulatory deadlines might affect when reports are due or audits occur, but they don’t establish the ongoing cadence for daily or continuous log reviews across the environment. Budget constraints can influence resources, but the policy and risk framework should drive the established frequency to ensure consistent risk management. For example, high-risk systems may have daily reviews, while less critical ones might follow a longer interval as dictated by policy.