A start$-$up organization is looking to gain access to payment processing networks but has been told they need a documented IT environment before they can be reviewed. Of the following, which has the goal of providing an implementable set of security controls for the IT environment and documenting the processes, procedures, and policies used to perform the implementation?

A

BCP

B

Information security policy

C

Change management policy

D

DRP