When developing security processes for handling credit card data on the business unit's information system, the information security manager should FIRST:

To support effective risk decision making, which of the following is MOST important to have in place?

Which of the following should an information security manager do FIRST after discovering that a business unit has implemented a newly purchased application and bypassed the change management process?

Which of the following is MOST important for an information security manager to communicate to stakeholders when approving exceptions to the information security policy?

Which of the following is the MOST effective approach to ensure IT processes are performed in compliance with the information security policies?