Which of the following should be PRIMARILY included in a security training program for business process owners?

A. Impact of security risks
B. Application vulnerabilities
C. Application recovery time
D. List of security incidents reported