Which of the following should be the PRIMARY driver for selecting and implementing appropriate controls to address the risk associated with weak
user passwords?
a. The organization’s risk tolerance
b. The cost of risk mitigation controls
c. Direction from senior management
d. The organization's culture