Which of the following will provide the MOST guidance when deciding the level of protection for an information asset?

A. Cost of controls
B. Cost to replace
C. Classification of information
D. Impact to business function