Senior management has asked you to quantify the risks in your production Solaris Operating Environment. There are a number of ways you may attempt to measure the effectiveness of any of the safeguards you have implemented. When measuring residual risk, which statement is true?

A.
A false sense of security will always prevail.

B.
There is a law of diminishing return for security controls.

C.
The percentage of security breaches should be less than risk management calculations.

D.
The annualized loss expectancy should be less than the valuation of the assets multiplied by the residual risk factor.