Which is the MOST important driver for effectively communicating the progress of a new information security program's implementation to key stakeholders?

The FIRST step in establishing an information security program is to:

The PRIMARY objective of periodically testing an incident response plan should be to:

An information security manager has become aware that a third-party provider is not in compliance with the statement of work (SOW). Which of the following is the BEST course of action?

A new information security manager finds that the organization tends to use short-term solutions to address problems. Resource allocation and spending are not effectively tracked and there is no assurance that compliance requirements are being met What should be done FIRST to reverse this bottom-up approach to security?