Which of the following is incorrect regarding the purpose of a Written Information Security Plan $($WISP$)?$

A$.$ Ensure the security and confidentiality of all Personally Identifiable Information $($PII$)$ retained by the firm

B$.$ Allow Personally Identifiable Information $($PII$)$ to be used in marketing materials

C$.$ Protect Personally Identifiable Information $($PII$)$ against anticipated threats or hazards to the security or integrity of such information

D$.$ Protect against any unauthorized access to or use of Personally Identifiable Information $($PII$)$ in a manner that creates a substantial risk of Identity Theft