Which statement below is NOT correct about safeguard selection in the
risk analysis process?

A.
The most commonly considered criteria is the cost effectiveness of the
safeguard.

B.
The best possible safeguard should always be implemented, regardless
of cost.

C.
Maintenance costs need to be included in determining the total cost of
the safeguard.

D.
Many elements need to be considered in determining the total cost of
the safeguard.

Explanation:
The correct answer is “The best possible safeguard should always be implemented, regardless
of cost.”. Performing a cost-benefit analysis of the
proposed safeguard before implementation is vital. The level of security
afforded could easily outweigh the value of a proposed safeguard.
Other factors need to be considered in the safeguard selection
process, such as accountability, auditability, and the level of manual

operations needed to maintain or operate the safeguard.