When reviewing an organization’s information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:

When reviewing an organization’s information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:
A . a risk management process.
B. an information security framework.
C. past information security incidents.
D. industry best practices.

View Answer

Answer: B