When implementing security architecture, an information security manager MUST ensure that security controls:

A. form multiple barriers against threats.
B. are transparent.
C. are the least expensive.
D. are communicated through security policies.