If C represents the cost of instituting safeguards in an information system and L is the estimated loss
resulting from exploitation of the corresponding vulnerability, a legal liability exists if the safeguards
are not implemented when:

A.
C/L = a constant

B.
C>L

C.
C<L

D.
C = 2L

Explanation:
The correct answer is C<L. If the cost to implement the safeguards is less than the estimated loss
that would occur if the corresponding vulnerability were successfully exploited, then a legal liability
exists. The other answers are distracters.