Which of the following is BEST to include in a business case when the return on investment (ROI) for an information security initiative is difficult to calculate?

A. Estimated reduction in risk
B. Estimated increase in efficiency
C. Projected costs over time
D. Projected increase in maturity level