Who needs budgets? Are business critical applications reviewed and tested after changes to operating system platforms and are there restrictions to changes to software packages? Do you have a documented procedure for the use of cryptography in your environment? Has it been determined what needs to be monitored and measured, when, by whom, the methods to be used, and when the results will be evaluated? Are the staff undertaking ISMS roles competent,...