When selecting risk response options to manage risk, an information security manager’s MAIN focus should be on reducing:

A. exposure to meet risk tolerance levels.
B. the likelihood of threat.
C. financial loss by transferring risk.
D. the number of security vulnerabilities.