According to the National Institute of Standards and Technology (NIST)

According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

A) Susceptibility to attack, expected duration of attack, and mitigation availability
B) Attack vectors, controls cost, and investigation staffing needs
C) Susceptibility to attack, mitigation response time, and cost
D) Vulnerability exploitation, attack recovery, and mean time to repair