An information security $q,$ is a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training.

a$.$ plan

b$.$ framework

c$.$ model

d$.$ policy