A. The application owner must become knowledgeable about security risks, threats, classifications, and policies in order to define security requirements for his or her applications. The more on owner learns about security, the more secure his or her applications will become.

B. The application owner should hire a security expert to define security requirements for his or her applications, based on current Industry best practices. Actively implementing the latest trends will best ensure a secure application environment.

C. The application owner should recommend adherence to common established practices for assessments, classifications, architecture, and policies that have been defined, and are actively maintained, by security experts across the organization. Deviations may be necessary, but application owners should strive to be consistent with best practices that have been adopted by the organization.

D. The application owner, whenever possible, should elect to deploy applications into a public cloud computing environment. Doing so effectively delegates responsibility and accountability of concerns to another company. The owner doesn't need to be concerned with security as long as the cloud provider has been certified.