The primary purpose of vulnerability assessments is to identify known weaknesses before they can be exploited by attackers.
Option A: Security awareness is a benefit but not the main purpose.
Option C: Improving posture is an outcome, not the direct purpose.
Option D: Protection against threats is broader than vulnerability assessment.

Changing default passwords on IoT devices is a fundamental security control that aligns with standard information security procedures. Default credentials are widely known and often exploited, so resetting them significantly reduces the risk of unauthorized access to IoT devices and networks.

A Certification Practice Statement (CPS) is a detailed document that describes the practices a Certificate Authority (CA) uses when issuing and managing digital certificates. It includes procedures for handling compromised private keys, revocation, renewal, and security controls.
Certificate policy (B): High-level rules governing certificate usage, but not operational details.
PKI disclosure statement (C): Provides users with general PKI-related information.
Certificate revocation list (D): A technical mechanism listing revoked certificates, but not the procedures for managing compromise.

In this scenario, it is essential for the IS auditor to reassess the risk that remains due to the lack of funding for the recommended solution. The auditor should evaluate whether the risk is significant enough to require further action or if alternative, lower-cost mitigations can be implemented. This helps ensure that the organization is still aware of and managing the risk, even if the full recommendation cannot be implemented at this time.
Removing the finding or closing it without proper risk assessment would not be appropriate, as the risk may remain unaddressed. Recommending an increase in the IT budget may not be feasible or within the auditor's purview. Therefore, reassessing the risk is the most prudent response.