Multiple choice. Please give a brief explanation for your answer.

The implementation of a security program was started in an enterprise. Security controls to address confidentiality and availability have been included in the program. What else should be included? A) Ensure critical systems provide uninterrupted service. B) Protect data-in-transit from unauthorized disclosure. C) Ensure systems are not susceptible to unauthorized changes. D) Secure data to prevent unauthorized disclosure.