Question

In an organization where an IT security baseline has been defined, an IS auditor should FIRST ensure:

a). Implementation.
b). Compliance.
c). Documentation.
d). Sufficiency.

Answer 1

An IS auditor should first ensure implementation, followed by compliance and sufficiency, in an organization with an IT security baseline defined.

Step-by-step explanation:

In an organization where an IT security baseline has been defined, an IS auditor should FIRST ensure implementation. This means that the organization should follow the defined baseline and implement the necessary security measures. Without proper implementation, other aspects like compliance and sufficiency won't matter.

Once implementation is confirmed, the IS auditor can then move on to check for compliance, ensuring that the organization is following the required security standards and protocols. Documentation is also important as it provides evidence of the implemented security measures.

Finally, sufficiency should be assessed to determine if the implemented security measures are adequate for protecting the organization's information and systems.