Which statement with regard to Information Security Management is true?

A.
Information Security Management to specifically focus on managing Information Security effective within all information systems.

B.
Management with appropriate authority shall approve an Information Security policy.

C.
Security Incidents need to be reported and recorded immediately in line with the Problem Management procedure.

D.
Security Incidents shall only be reported and recorded if they affect more than one user