Which of the following should an information security manager do FIRST when noncompliance with security standards is identified?
Report the noncompliance to senior management.
Validate the noncompliance.
Include the noncompliance in the risk register.
Implement compensating controls to mitigate the noncompliance.
Submit