US-CERT is a set of moderated mailing lists full of detailed, full-disclosure discussions and announcements about computer security vulnerabilities. It is sponsored in part by SecurityFocus. __________

Which of the following best describes an assessment?

A. Evidenced-based examination that compares current practices against a specific internal or external criteria B. A focused privileged inspection to determine condition, locate weakness or vulnerabilities, and identity corrective actions C. Testing controls by performing vulnerability assessment tests that simulate real attacks D. Configuring the System and Security logs on each system to record and audit activities

What activity is more conceptual than technical, and helps to ensure proper alignment between product and eventual use use?

Fill in the blank(s) with the appropriate word(s).