Which of the following is not true of a baseline approach to security controls?

A baseline approach to security controls may miss non$-$standard threats and vulnerabilities.

A baseline approach to security controls can be excessive in terms of risk exposure for a particular control.

A baseline approach to security controls follows a minimum set of information safeguards.

A baseline approach to security controls identifies all assets.