What should the auditor recommend be done FIRST?

exams CISA V0 CISA exam 0 Comments

An IS auditor finds that a key Internet-facing system is vulnerable to attack and that patches are not available.

What should the auditor recommend be done FIRST?
A . Implement a new system that can be patched.
B. Implement additional firewalls to protect the system.
C. Decommission the server.
D. Evaluate the associated risk.

Answer: D