A security policy states that all applications on the network must have a password length of eight characters. There are three legacy applications on the network
that cannot meet this policy. One system will be upgraded in six months, and two are not expected to be upgraded or removed from the network. Which of the
following processes should be followed?
A.
Establish a risk matrix
B.
Inherit the risk for six months
C.
Provide a business justification to avoid the risk
D.
Provide a business justification for a risk exception