Which statement below is NOT correct about safeguard selection in the risk analysis process?

A.
The most commonly considered criteria is the cost effectiveness of the safeguard.

B.
The best possible safeguard should always be implemented, regardless of cost.

C.
Maintenance costs need to be included in determining the total cost of the safeguard.

D.
Many elements need to be considered in determining the total cost of the safeguard.

Explanation:
The correct answer is “The best possible safeguard should always be implemented, regardless of
cost.”. Performing a cost-benefit analysis of the proposed safeguard before implementation is vital.
The level of security afforded could easily outweigh the value of a proposed safeguard. Other factors
need to be considered in the safeguard selection process, such as accountability, auditability, and
the level of manual operations needed to maintain or operate the safeguard.