Refer to the information below to answer the question.
An organization has hired an information security officer to lead their security department. The
officer has adequate people resources but is lacking the other necessary components to have an
effective security program. There are numerous initiatives requiring security involvement.
The security program can be considered effective when

A.
vulnerabilities are proactively identified.

B.
audits are regularly performed and reviewed.

C.
backups are regularly performed and validated.

D.
risk is lowered to an acceptable level.