An information security manager has identified and implemented migrating controls according to industry best practices. Which of the following is the GREATEST risk associated with this approach?

A. Important security controls may be missed without senior management input.
B. The cost of control implementation may be too high.
C. The migration measures may not be updated in a timely manner.
D. The security program may not be aligned with organizational objectives.