Information Security Management case question

daven9947