An information security manager wishing to establish security baselines would:

A.
include appropriate measurements in the system development life cycle.

B.
implement the security baselines to establish information security best practices.

C.
implement the security baselines to fulfill laws and applicable regulations in different jurisdictions.

D.
leverage information security as a competitive advantage.

Explanation:

While including appropriate measurements in the system development life cycle may indicate a security baseline practice; these are wider in scope and, thus, implementing security baselines to establish information security best practices is the appropriate answer. Implementing security baselines to fulfill laws and applicable regulations in different jurisdictions, and leveraging information security as a competitive advantage may be supplementary benefits of using security baselines.