 The next question an auditor should ask is what critical information this network must protect.Things such as enterprise systems, mail servers, web servers, and host applications accessed by customers are typically areas of focus.It is also important to know who has access and to what parts.