B. performing a comprehensive …

B. performing a comprehensive threat analysis
C. conducting a standard risk assessment
D. transferring all risks to third parties