What characterizes a Tier 1 (Partial) organization?

• A.The organization has formal policy approved by executives and sometimes shares threat indicators with sector peers through an ISAC
• B.The organization maintains documented risk procedures for each business unit and sometimes revises them after an audit finding or a major incident reported by a peer
• C.The organization monitors threat feeds in real time and sometimes automates its response to indicators with machine learning across its supply chain partners
• D.The organization's cybersecurity risk management practices are not formalized and risk is managed in an ad hoc and sometimes reactive manner