In what part of the process to grant access to a system does the user present a token?

Why do we need to test a disaster recovery plan regularly, and keep it up to date?

What would be the reference for you to know who should have access to data/document?

As a new member of the IT department you have noticed that confidential information has been leaked several times. This may damage the reputation of the company. You have been asked to propose an organisational measure to protect laptop computers. What is the first step in a structured approach to come up with this measure?

You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You decide to take measures for the large risks but not for the small risks.
What is this risk strategy called?