A Chief Information Security Officer Received a List of High

A Chief Information Security Officer received a list of high, medium, and low impact audit findings. Which of the following represents the BEST course of action?

A) If the findings do not impact regulatory compliance, remediate only the high and medium risk findings.
B) If the findings do not impact regulatory compliance, review current security controls.
C) If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost.
D) if the findings impact regulatory compliance, remediate the high findings as quickly as possible.