The Only Use of the Acceptance Strategy That Industry Practices

Multiple Choice

The only use of the acceptance strategy that industry practices recognize as valid occurs when the organization has done all but which of the following?

A) Determined the level of risk posed to the information asset
B) Performed a thorough cost-benefit analysis
C) Determined that the particular function, service, information, or asset did justify the cost of additional protection
D) Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability