Which of the following should an IS auditor expect to find in an organization’s information security policies?

A. Authentication requirements
B. Asset provisioning lifecycle
C. Security configuration settings
D. Secure coding procedures