Which statement best describes GAS's approach to a compliant security process?

• A. A manual process with no auditing.
• B. A process that prohibits publishing advisories.
• C. An auditable security process including advisories and vulnerability management.
• D. A process that only tracks incidents after resolution.

Answer: (C)

A compliant security process hinges on being auditable and having a complete cycle for communicating and fixing issues. An auditable system provides traceability—you can show what was done, when, by whom, and with what result—so audits and external reviews can verify compliance. Including advisories ensures vulnerabilities are disclosed and communicated to stakeholders in a timely, coordinated way, which is a crucial part of responsible security practice. Vulnerability management covers the full lifecycle—from discovery and assessment through remediation and verification—so issues are not only identified but tracked and resolved systematically. Together, these elements create a transparent, accountable security program that meets compliance expectations. The other approaches lack this combination: no auditing removes traceability; prohibiting advisories eliminates necessary transparency and coordination; and tracking incidents only after resolution misses proactive risk management and ongoing improvement.