A security audit verifies compliance and a security assessment validates vulnerabilities. An organization should employ both to capture complete perspective of the overall security stance. A company should know where violations happen or vulnerabilities exist in their own networks. Auditing system policies and assessing system security require certain procedures in a specific order.

1.Assume that you are a member of the auditors team, and you have been asked to prepare a list of what the auditors would audit.

2.Now assume that you are one of the IT organizations members. Discuss how they would prepare themselves for an audit