An organization is considering whether to allow employees to use personal computing devices for business purposes. To BEST facilitate senior management-s decision, the information security manager should:

A. map the strategy to business objectives

B. perform a cost-benefit analysis

C. conduct a risk assessment

D. develop a business case