When evaluating information security management, which of the following are not items the IS auditor would consider commenting on as a potential control weakness?
A. A security program had not been developed using a risk-based approach.
B. The information security officer does not accept respons ... (More)
↧