In an organization where an IT security baseline has been defined, an IS auditor should FIRST
ensure:
A.
implementation.
B.
compliance.
C.
documentation.
D.
sufficiency.
Explanation:
An IS auditor should first evaluate the definition of the minimum baseline level by ensuring the
sufficiency of controls. Documentation, implementation and compliance are further steps.
I think it should be B
check if complied then check for sufficiency of baseline controls.
Answer is D. D. An IS auditor should first evaluate the definition of the minimum baseline level by ensuring the sufficiency of the control baseline to meet security requirements.