Which of the following is MOST relevant for an information security manager to communicate to IT operations?

A. The level of inherent risk
B. Vulnerability assessments
C. Threat assessments
D. The level of exposure