After mapping generic risk scenarios to organizational security policies, the NEXT course of action should be to:

A. record risk scenarios in the risk register for analysis
B. validate the risk scenarios for business applicability
C. reduce the number of risk scenarios to a manageable set
D. perform a risk analysis on the risk scenarios