A man in a business suit sitting down and holding a microphone.
A man is sitting.
The auditors then develop two ratings on a scale of 1 to 5: One rating to indicate the effectiveness of information security controls and a second rating to indicate the level of management awareness.