Which of the following is the MOST effective way to identify changes in an information security environment?

A. Continuous monitoring
B. Security baselining
C. Annual risk assessments
D. Business impact analysis