Which of the following should be implemented to protect an organization from spam?

Auditing involves reviewing logs and records for accountability purposes and does not prevent or block spam from being delivered.

System hardening reduces the attack surface of an operating system or service by disabling unnecessary features, but does not filter unsolicited email content.

E-mail filtering solutions such as anti-spam gateways inspect incoming messages using techniques like content analysis, blacklists, and sender reputation to identify and quarantine spam. This directly targets the spam threat vector - the email system itself. Other controls do not address the email delivery mechanism that spam exploits.

Packet filtering operates at the network layer to allow or deny traffic based on IP addresses and ports, but cannot inspect email content to identify spam.