Win2k3 Server Audits

[whowe]

We currently reviewing our vendors scope of work in relations to IT auditing. Several questions have arisen which I need other professional input to form a solid conclusion.

Here are my questions:

Servers that have no direct impact on customers and only contain users files should be audited with Nessus every <x>?

Servers that hold customer information and possibly payment information should be audited with Nessus every <x>?

Exchange server should be audited with Nessus every <x>?

All help in this matter is greatly appreciated!