_________ is a formal process to ensure that critical assets are sufficiently protected in a cost-effective manner.
A. Configuration management control
B. IT security management
C. Detection and recovery control
D. Security compliance