I would go with C. The key objectives of the security program ------------------------------ Bahaa Hussein, Head of IT Infrastructure Operations ------------------------------

I would go with B: The program is validated against vendor specifications ------------------------------ Bahaa Hussein, Head of IT Infrastructure Operations ------------------------------

I would go with A. a risk treatment plan ------------------------------ Bahaa Hussein, Head of IT Infrastructure Operations ------------------------------