The concept of Due Care states that senior organizational management must ensure that:

A.
Certain requirements must be fulfilled in carrying out their responsibilities to the organization.

B.
Other management personnel are delegated the responsibility for information system security.

C.
All risks to an information system are eliminated.

D.
The cost of implementing safeguards is greater than the potential resultant losses resulting from
information security breaches.

Explanation:
* Answer “All risks to an information system are eliminated” is incorrect because all risks to
information systems cannot be eliminated * answer “Other management personnel are delegated
the responsibility for information system security” is incorrect because senior management cannot
delegate its responsibility for information system security under due care * answer “The cost of
implementing safeguards is greater than the potential resultant losses resulting from information
security breaches” is incorrect because the cost of implementing safeguards should be less than or
equal to the potential resulting losses relative to the exercise of due care.