 Do customers and vendors have access to systems on the network?Can employees access information from home?Lastly the auditor should assess how the network is connected to external networks and how it is protected.