Organizations Must Consider All but Which of the Following During

Organizations must consider all but which of the following during development and implementation of an information security measurement program?

A) Measures must yield quantifiable information (percentages, averages, and numbers)
B) Data that supports the measures needs to be readily obtainable
C) Only repeatable information security processes should be considered for measurement
D) Measures must be useful for tracking shortfalls in organizational resources