Implementing a strong password policy is part of an organization’s information security strategy for the year. A business unit believes the strategy may adversely affect a client’s adoption of a recently developed mobile application and has decided not to implement the policy.
Which of the following is the information security manager’s BEST course of action?

A. Analyze the risk and impact of not implementing the policy.
B. Develop and implement a password policy for the mobile application.
C. Escalate non-implementation of the policy to senior management.
D. Benchmark with similar mobile applications to identify gaps.