What is the MOST important purpose of testing the Disaster Recovery Plan (DRP)?

Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

Refer to the information below to answer the question.
An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.
Which of the following is considered the MOST important priority for the information security officer?

What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?

What is the MAIN purpose of a change management policy?