A security policy states that all applications on the network must have a password length of eight characters.
There are three legacy applications on the network that cannot meet this policy. One system will be upgraded in
six months, and two are not expected to be upgraded or removed from the network. Which of the following
processes should be followed?
A.
Establish a risk matrix
B.
Inherit the risk for six months
C.
Provide a business justification to avoid the risk
D.
Provide a business justification for a risk exception