A business case for investment in an information security management infrastructure MUST include:

A. evidence that the proposed infrastructure is certified.
B. specifics on the security applications needed.
C. data management methods currently in use.
D. impact of noncompliance with applicable standards.