When deciding on a strategy to mitigate IS$-$related security risks which of the following is not a factor that should be considered?

Group of answer choices

Degree of desired security

Convenience for IS users

Number of IS security incidents in the year $2000$

Investment necessary to achieve security