How should you determine what controls from the baseline a given system or software package should receive?
A. Consult the custodians of the data.
B. Select based on the data classification of the data it stores or handles.
C. Apply the same controls to all systems.
D. Consult the business owner of the process the system or data supports.