An information security manager believes that information has been classified inappropriately, increasing the risk of a breach. Which of the following is the information security manager's BEST action?

Which of the following is the GREATEST benefit of conducting an organization-wide security awareness program?

For the information security manager, integrating the various assurance functions of an organization is important PRIMARILY to enable:

Which of the following should be the PRIMARY factor in prioritizing responses to a security incident?

When reviewing the security controls of an application service provider, an information security manager discovers the provider's change management controls are insufficient. Changes to the provided application often occur spontaneously with no notification to clients. Which of the following would BEST facilitate a decision to continue or discontinue services with this provider?