A newly hired information security manager reviewing an existing security investment plan is MOST likely to be concerned when the plan:

A. is based solely on a review of security threats and vulnerabilities in existing IT systems
B. identifies potential impacts that the implementation may have on business processes
C. focuses on compliance with common international security standards
D. has summarized IT costs for implementation rather than providing detail