An IS auditor finds that a key Internet-facing system is vulnerable to attack and that...

The first step in addressing a vulnerability is to evaluate the associated risk, which involves assessing the likelihood and impact of a potential exploit. Based on the risk assessment, the appropriatemitigation strategy can be determined, such as implementing a new system, addingfirewalls, or decommissioning the server. References: ISACA CISA Review Manual 27th Edition, page 280