An effective information security strategy is PRIMARILY based upon which of the following?

A、 Risk management practices
B、 Security budget constraints
C、 Security control implementation
D、 Industry and regulatory standards