$18.$

I. Regular assessment of selected security controls

II$.$ Configuration and control management processes

III. Change management processes

IV$.$ Annual audit of the security environment

The above are essential components of:

A$.$ IT risk assessment

B$.$ IT compliance maintenance

C$.$ Compensating controls

D$.$ Privacy management