Threat and vulnerability assessments are important PRIMARILY because they are:

A. needed to estimate risk
B. the basis for setting control objectives
C. elements of the organization’s security posture
D. used to establish security investments