Section: INFORMATION RISK MANAGEMENT

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation/Reference: https://searchdisasterrecovery.techtarget.com/answer/Whats-the-difference-between-a-hot-site- and-cold-site-for-disaster-recovery

Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
Developing an information security baseline helps to define the minimum acceptable security that will be implemented to protect the information resources in accordance with the respective criticality levels. Before determining the security baseline, an information security manager must establish the security policy, identify criticality levels of organization's information resources and assess the risk environment in which those resources operate.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
No new process will be successful unless it is adhered to by all stakeholders; to the extent stakeholders have input, they can be expected to follow the process. Without consensus agreement from the stakeholders, the scope of the research is too wide; input on the current environment is necessary to focus research effectively.
It is premature to implement procedures without stakeholder consensus and research. Without knowing what the process will be the parameters to baseline are unknown as well.