Within an organization's vulnerability management program, who has the responsibility to implement remediation actions?

An IT auditor has recently discovered that because of a shortage of skilled operations personnel, the security administrator has agreed to work one late night shift a week as the senior computer operator. The most appropriate course of action for the IT auditor is to:

The total cost of security controls should:

Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?

The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called___________________.