An IS auditor finds that not all employees are aware of the enterprise’s information security policy.
The IS auditor should conclude that:

The development of an IS security policy is ultimately the responsibility of the:

Which of the following programs would a sound information security policy MOST likely include to
handle suspected intrusions?

Which of the following should be included in an organization’s IS security policy?

Which of the following is the initial step in creating a firewall policy?

The management of an organization has decided to establish a security awareness program. Which
of the following would MOST likely be a part of the program?

Which of the following is MOST critical for the successful implementation and maintenance of a
security policy?

A comprehensive and effective e-mail policy should address the issues of e-mail structure, policy
enforcement, monitoring and:

In an organization where an IT security baseline has been defined, an IS auditor should FIRST ensure:

To ensure an organization is complying with privacy requirements, an IS auditor should FIRST review: