Justifying information security projects
A) is not done because ROI calculators are not available.
B) is not needed because it is well-known that preventing network security problems is less labor intensive than cleaning up virus infections.
C) should be done because employee security training is usually poorly done.
D) should focus on defending against external threats such as hackers and malware.
Answer: C