Exam CISA topic 1 question 650 discussion

The first one means policy. You have to establish a standard so everything else can be built around it.

It is important to first implement a proxy server to control access to certain internet sites, and then update your security policies to clarify the rules and regulations for internet usage.

I vote for D

C. include a statement in its security policy about Internet use

I think its C. Before implementing any technical controls or monitoring measures, it is essential for the organization to establish clear policies and guidelines regarding Internet use. By including a statement in its security policy about Internet use, the organization sets expectations and provides employees with guidelines on acceptable and secure Internet usage.

the organization should FIRST use a proxy server to filter out Internet sites that should not be accessed, as this provides an effective means of controlling access to the Internet and preventing users from accessing non-business-related websites or services that could compromise the security of the corporate network.