When designing security controls, it is MOST important to:

A. apply a risk-based approach.
B. focus on preventive controls.
C. evaluate the costs associated with the controls.
D. apply controls to confidential information.