The PRIMARY objective of a risk response strategy should be:

A. threat reduction.
B. regulatory compliance.
C. senior management buy-in.
D. appropriate control selection.