What would be an information security manager’s BEST course of action when notified that the implementation of some security controls is being delayed due to budget constraints?

A. Prioritize security controls based on risk.
B. Request a budget exception for the security controls.
C. Begin the risk acceptance process.
D. Suggest less expensive alternative security controls.