Which role does security metrics play in protecting information resources?

A. ignoring risks and controls B. measurable indicators of security performance C. bypassing management approval D. disabling audit logs