Which of the following is most relevant to determining the maximum effective cost of access control?

A.
the value of information that is protected.

B.
management’s perceptions regarding data importance.

C.
budget planning related to base versus incremental spending.

D.
the cost to replace lost data.

Explanation:
The cost of access control must be commensurate with the value of the information that is being protected.
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of
Computer Security, 2001, John Wiley & Sons, Page 49