A newly-appointed risk management director for the IT department at Company XYZ, a major
pharmaceutical manufacturer, needs to conduct a risk analysis regarding a new system which the
developers plan to bring on-line in three weeks. The director begins by reviewing the thorough and
well-written report from the independent contractor who performed a security assessment of the

system. The report details what seems to be a manageable volume of infrequently exploited
security vulnerabilities. The likelihood of a malicious attacker exploiting one of the vulnerabilities is
low; however, the director still has some reservations about approving the system because of
which of the following?

A small company has a network with 37 workstations, 3 printers, a 48 port switch, an enterprise
class router, and a firewall at the boundary to the ISP. The workstations have the latest patches
and all have up-to-date anti-virus software. User authentication is a two-factor system with
fingerprint scanners and passwords. Sensitive data on each workstation is encrypted. The network
is configured to use IPv4 and is a standard Ethernet network. The network also has a captive
portal based wireless hot-spot to accommodate visitors. Which of the following is a problem with
the security posture of this company?

Statement: “The system shall implement measures to notify system administrators prior to a
security incident occurring.”
Which of the following BEST restates the above statement to allow it to be implemented by a team

of software developers?