$14.$ Which of the following is not true of a baseline approach to security controls?

"A baseline approach to security controls identifies all assets

A baseline approach to security controls follows a minimum set of information safeguards

A baseline approach to security controls can be excessive in terms of risk exposure for a particular control

A baseline approach to security controls may miss non$-$standard threat and vulnerabiliers