A.Review and update security policy on a regular basis

B.An expanded and more effective monitoring and detection process for incidents

C.An appropriate investigation into the root cause with corrective measures applied

D.Management support and approval of the incident response plan

A.reflect the corporate risk culture.

B.support major information security initiatives.

C.reduce information security program spending.

D.demonstrate the effectiveness of the security program.

A.each party s security responsibilities.

B.penalties for noncompliance with security policy

C.details of expected security metrics

D.recovery time objectives (RTOs).

A.Cross-training

B.Risk avoidance

C.Risk prioritization

D.Threat management

A.Providing a basis for implementing a need-to-know policy

B.Defining resource ownership

C.Supporting segregation of duties

D.Helping to determine the recovery point objective (RPO)