Which option represents a step that should be taken when a security policy is developed?

A.
Perform penetration testing.

B.
Determine device risk scores.

C.
Implement a security monitoring system.

D.
Perform quantitative risk analysis.