During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a critical business application. The application owner did not approve the patch installation to avoid interrupting the application. Which of the following should be the information security manager's FIRST course of action?

An organization outsources its payroll processing. Which of the following would be the BEST key risk indicator for monitoring the information security of the service provider?

The PRIMARY role of an information security steering group is to ensure that:

Which of the following should be define* I FIRST when creating an organization's information security strategy?

An incident response team has determined there is a need to isolate a system that is communicating with a known malicious host on the Internet, following stakeholders should be contacted FIRST?