The concept of Due Care states that senior organizational management
must ensure that:

A.
Certain requirements must be fulfilled in carrying out their responsibilities
to the organization.

B.
Other management personnel are delegated the responsibility for information system security.

C.
All risks to an information system are eliminated.

D.
The cost of implementing safeguards is greater than the potential resultant losses resulting
from information security breaches.

Explanation:
* Answer “All risks to an information system are eliminated” is incorrect because all risks to
information systems cannot be eliminated
* answer “Other management personnel are delegated the responsibility for information system
security” is incorrect because senior management cannot delegate its responsibility for information
system security under due care
* answer “The cost of implementing safeguards is greater than the potential resultant losses
resulting from information security breaches” is incorrect because the cost of implementing
safeguards should be less than or equal to the potential resulting losses relative to the exercise of

due care.