Which of the following statements are true?

Select one or more:

A$.$ The criterion most commonly used when evaluating a strategy to implement InfoSec controls and safeguards is economic feasibility.

B$.$ Risk transference focuses on reducing the impact if the vulnerability is exploited.

C$.$ Residual risk is the amount of risk that remains after the organization has implemented policy, education and training, and technical controls and safeguards.

D$.$ The Cost$-$Benefit Analysis determines whether the benefit from a control alternative is worth the associated cost of implementing and maintaining the control.

E$.$ The exposure factor is the calculated value associated with the most likely loss from a single occurrence of a specific attack.