Explanation
The link to business objectives is the most important clement that would be considered by management.
Information security metrics should be put in the context of impact to management objectives. Although important, the security knowledge required would not be the first element to be considered. Baselining against the information security metrics will be considered later in the process.

Section: INCIDENT MANAGEMENT AND RESPONSE
Explanation:
The key step in such an incident is to report it to mitigate any loss. After this, the other actions should follow.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Explanation
To be successful in implementing restrictive password policies, it is necessary to obtain the buy-in of the end users. The best way to accomplish this is through a security awareness program. Regular password audits and penalties for noncompliance would not be as effective on their own; people would go around them unless forced by the system. Single sign-on is a technology solution that would enforce password complexity but would not promote user compliance. For the effort to be more effective, user buy-in is important.