Which of the following should not be used as a basis for determining new controls that might be implemented over information systems assets?

a. Choose controls that emphasize design secrecy

b. Examine the types of controls used over the same types of information systems assets in other organizations

c. Analyze the scenarios developed during the exposures analysis phase

d. Review the answers to questions on the internal control questionnaires completed during the exposures analysis phase