Which of the following should be of GREATEST concern to an IS auditor conducting an audit of an organization that recently experienced a ransomware attack?

While antivirus failure is a concern, no single security control is foolproof, and ransomware often exploits other vectors; the ability to recover from a backup is more critical than the initial prevention method for business continuity.

If backups are only stored within the local network, they are highly susceptible to being encrypted or deleted by the same ransomware attack that compromised the primary data. This severely impairs the organization's ability to recover its data without paying the ransom, representing a critical failure in resilience and data protection strategy against ransomware.

Not testing security patches prior to implementation is a risk in terms of system stability, but the *absence* of proper, isolated backups is a direct and catastrophic failure in recovering from a ransomware attack.

Lack of employee training contributes to attack susceptibility (e.g., phishing), but the most immediate and critical concern post-attack is the ability to recover data, which directly relies on the integrity and isolation of backups.