What is the FIRST step that should be considered in a Data Loss Prevention (DLP) program?

The Chief Executive Officer (CEO) wants to implement an internal audit of the company's
information security posture. The CEO wants to avoid any bias in the audit process;
therefore, has assigned the Sales Director to conduct the audit. After significant interaction
over a period of weeks the audit concludes that the company's policies and procedures are sufficient, robust and well established. The CEO then moves on to engage an external
penetration testing company in order to showcase the organization's robust information
security stance. This exercise reveals significant failings in several critical security controls
and shows that the incident response processes remain undocumented. What is the MOST
likely reason for this disparity in the results of the audit and the external penetration test?

he security organization is loading for a solution that could help them determine with a
strong level of confident that attackers have breached their network. Which solution is
MOST effective at discovering successful network breach?

When resolving ethical conflicts, the information security professional MUST consider many
factors. In what order should these considerations be prioritized?

What is the FIRST step prior to executing a test of an organisation’s disaster recovery (DR) or business continuity plan (BCP)?