On what basis should Judy set the level of security for corporate-owned facilities?

• A. Budget constraints
• B. Aesthetic considerations
• C. Legal compliance
• D. Business requirements

Answer: (D)

Security levels should be determined by what the business needs to protect and how it operates. A risk assessment identifies the most critical assets, people, and functions, and the threats they face, which then drives the level of security controls required. This approach ensures protections are proportionate to risk and supportive of day-to-day operations. Budget constraints can influence implementation but do not define the necessary protection; aesthetics do not drive security decisions; and legal compliance matters, while important, are part of meeting business needs and risk requirements—not the sole basis for setting the level.