The purpose of a written information security plan includes all of the following except:

A- Ensure the security and confidentiality of all personally identifiable information (PII) retained by the firm

B- Allow personally identifiable information (PII) to safely be used in marketing materials

C- Protect personally identifiable information (PII) against anticipated threats or hazards to the security or integrity of such information

D- Protect against any unauthorized access to or use of personally identifiable information (PII) in a manner that creates a substantial risk of identity theft.