Which of the following is not a compensating measure for access violations?

Which of the following is not a compensating measure for access violations?

A.
Backups

B.
Business continuity planning

C.
Insurance

D.
Security awareness