Which of the following should be an information security manager's PRIMARY focus during the development of a critical system storing highly confidential data?

A. Ensuring the amount of residual risk is acceptable
B. Reducing the number of vulnerabilities detected
C. Avoiding identified system threats
D. Complying with regulatory requirements