The board of directors of a major retail chain wants to know what capabilities are in place to prevent customer credit card data from being hacked. Which of the following should be established to provide useful information about a potential future event?

A. Risk tolerance
B. Lead indicators
C. Lag indicators
D. Performance indicators