A new employee is starting work at your company. When should they be informed of the company's security policy?

Your organization has tasked you with collecting information on all the data, personnel, devices, systems, and facilities that enable the organization to achieve its business purposes.
Which part of the NIST Cybersecurity Framework would you consult first?

An administrator receives an alert that four Microsoft Windows machines have joined the network but do not have the appropriate level of patching to be authorized.
Which category addresses this issue?

In which function is the SDLC implemented?

A security engineer is responsible for monitoring company software, firmware, system OS, and applications for known vulnerabilities.
How should they stay current on exploits and information security?