The GTAG organizes relevant risks and controls into three groups: Security in Design; Prevention; and Detection.

1. Why are email accounts such a frequent source of cyber risk? Describe two controls that you would expect the CISO to have implemented.
2. In a vulnerability management process, the IS team is generally receiving notifications of vulnerabilities and patches that affect in-service applications, while the IT teams that manage the applications have to test new patches before they are implemented, to make sure everything still works together. So, if an audit of patch management controls found that critical vulnerabilities were not being addressed timely (per company policies), what should the auditor recommend as a corrective action?