Which of the following practices effectively integrates cybersecurity directly into routine organizational operations?

### Why this is right - **A** is correct: a risk-based approach directs attention and resources toward important assets and plausible threats. - **B** is correct: security by design places protective features into systems and processes early, helping reduce weaknesses before deployment. - **C** is correct: continuous monitoring supports timely detection and response as conditions change. ### The concept Operational integration means security practices are part of ordinary business and technology work. Training can reduce human error, while incident response planning prepares teams to act when an attack occurs. These activities complement prevention and monitoring rather than replacing them. ### The other options - **D. Treat employee training and incident response planning as unrelated to security operations.** Both are operational security practices; training addresses human actions and response plans organize action during incidents. - **E. Rely on a one-time review instead of monitoring for changes.** A one-time review cannot provide ongoing awareness of changing threats and system conditions. ### Terms - **Risk-based approach**: Prioritizing security work by considering the importance of assets and the likelihood and impact of threats. - **Security by design**: Incorporating security into systems and processes from their initial design. - **Continuous monitoring**: Ongoing observation of systems or security activity to identify changes and threats. ### Remember Integrate security into routine work, then keep monitoring whether protections remain effective.