Section: INFORMATION RISK MANAGEMENT
Explanation:
Security controls must be compatible with business needs. It is not feasible to eliminate all vulnerabilities.
Usage by similar organizations does not guarantee that controls are adequate. Certification by a third party is important, but not a primary concern.

Section: INFORMATION RISK MANAGEMENT
Explanation:
The assigned class of sensitivity and criticality of the information resource determines the level of access controls to be put in place. The assignment of sensitivity and criticality takes place with the information assets that have already been included in the information security program and has only an indirect bearing on the costs to be incurred. The assignment of sensitivity and criticality contributes to, but does not decide, the overall budget of the information security program.

Explanation/Reference:
Explanation:
A security gap analysis is a process which measures all security controls in place against typically good business practice, and identifies related weaknesses. A business impact analysis is less suited to identify security deficiencies. System performance metrics may indicate security weaknesses, but that is not their primary purpose. Incident response processes exist for cases where security weaknesses are exploited.