A computer system containing personal identification information is being implemented by a
company’s sales department. The sales department has requested that the system become
operational before a security review can be completed. Which of the following can be used to
explain the reasons a security review must be completed?

A.
Need to know policy

B.
Risk assessment

C.
Corporate security policy

D.
Vulnerability assessment