When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:

When reviewing an organization’s information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:

exams CISA V1 CISA exam 0 Comments

When reviewing an organization’s information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:
A . a risk management process.
B. an information security framework.
C. past information security incidents.
D. industry best practices.

Answer: B