Which of the following is the BEST approach for selecting controls to minimize risk?

Industry best practices provide a baseline but may not be optimal or cost-effective for a specific organization's unique risk profile.

A risk assessment identifies risks and their impact, but it doesn't inherently determine which controls are best or most efficient to implement.

A cost-benefit analysis ensures that the cost of implementing a control does not outweigh the potential reduction in risk or the value of the asset being protected. This optimizes resource allocation for risk mitigation.

Control-effectiveness evaluation assesses how well existing controls work, but it doesn't guide the initial selection of new controls for minimizing risk.