SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit...

 First Action After Receiving an Audit Report

The CISO must first validate the findings to ensure the accuracy of identified gaps. This includes confirming the audit results and deciding whether to accept or dispute the findings based on evidence.

This step ensures that the organization focuses on addressing genuine issues and avoids unnecessary remediation efforts.

 Why Not Other Options?

A. Inform peer executives: Premature without validating the accuracy of the findings.

C. Create remediation plans: Cannot proceed without validating the gaps.

D. Determine adequacy of policies: A broader task that comes after validating specific findings.

 EC-Council References

Emphasizes the importance of validating audit findings before proceeding with remediation or executive reporting.