A.Business case

B.Business impact analysis (B1A)

C.Threat assessment

D.Risk analysis

A.A comprehensive list of business processes performed by each business unit

B.Inclusion of business unit management In the Information security steering committee

C.Involvement of senior management in information security policy development

D.Targeted user security awareness programs for business units outside of IT

A.current threat level.

B.risk appetite.

C.risk register.

D.risk response capability.

A.Data storage capabilities

B.Selection of tools

C.Data ownership

D.Data classification

A.Information security organizational structures and responsibilities

B.Cost reduction techniques for information security investments

C.Information security program needs

D.Current and future desired state of information security