Question 362:
Which of the following is the BEST source of information for an IS auditor to use when determining whether an organization`s information security policy is adequate?
Answer options:
A. Industry benchmarks B. Information security program plans C. Penetration test results D. Risk assessment results