You are working with your IT security manager, Sienna, on a project to implement a new firewall for a pharmaceutical company whose two primary customers are the Centers for Disease Control and Prevention (CDC) and the Food and Drug Administration (FDA). While planning the kickoff meeting, you suggest collaborating on a responsibility assignment matrix. Why?

a. A responsibility assignment matrix is necessary because the company operates in a highly regulated industry.

b. Because of the sensitive nature of the data and the risk associated with the project, the CDC and the FDA require a responsibility assignment matrix as part of the statement of work.

c. The RACI will identify those who are either affected or perceived to be affected by the project.

d.The completion of a reliability and maintainability matrix is part of the Statement on Standards for Attestation Engagements (SSAE16) for auditing purposes.