Mitigating technology risks to acceptable levels should be based PRIMARILY upon: 

Answer options:

A. business process reengineering.
B. business process requirement.
C. legal and regulatory requirements.
D. information security budget.

B