For a semester exam, which option is correct about sources of security requirements?

A. only developer mood B. laws, standards, threat models, business needs and stakeholder expectations C. only coffee breaks D. only screen size