If C represents the cost of instituting safeguards in an information system
and L is the estimated loss resulting from exploitation of the
corresponding vulnerability, a legal liability exists if the safeguards are
not implemented when:

A.
C/L = a constant

B.
C>L

C.
C<L

D.
C = 2L

Explanation:
The correct answer is C<L. If the cost to implement the safeguards is
less than the estimated loss that would occur if the corresponding
vulnerability were successfully exploited, then a legal liability exists.
The other answers are distracters.