Which statement best describes laws and regulations?

A. mandatory legal obligations for protecting information B. treating all information as public C. ignoring risks and controls D. disabling audit logs