Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation

Data and information required for penetration are shared with the testers, thus eliminating time that would otherwise have been spent on reconnaissance and gathering of information. Blind (black box) penetration testing is closer to real life than full disclosure (white box) testing. There is no evidence to support that human intervention is not required for this type of test. A full disclosure (white box) methodology requires the knowledge of the subject being tested.

Section: INFORMATION RISK MANAGEMENT
Explanation:
Although all of these are important, the list of action items is used to reduce or transfer the current level of risk.
The other options materially contribute to the way the actions are implemented.

Explanation
The need for senior management involvement and support is a key success factor for the implementation of appropriate security governance. Complexity of technology, budgetary constraints and conflicting business priorities are realities that should be factored into the governance model of the organization, and should not be regarded as inhibitors.