Section: INCIDENT MANAGEMENT AND RESPONSE
Explanation:
Updating virus signature files on a weekly basis carries the risk that the systems will be vulnerable to viruses released during the week; far more frequent updating is essential. All other issues are secondary to this very serious exposure.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Section: INFORMATION SECURITY GOVERNANCE
Explanation:
A set of security objectives, processes, methods, tools and techniques together constitute a security strategy.
Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.