A security control should

A security control should

A.
Allow for many exceptions.

B.
Cover all contingencies.

C.
Not rely on the security of its mechanism.

D.
Change frequently.