How does the Identify function address legal and regulatory requirements?

• A.Through the Asset Management category, it ensures the organization catalogs and tracks its hardware, software, data flow, and external system inventories across each business unit
• B.Through the Governance category, it ensures the organization understands and manages its regulatory, legal, and contractual cybersecurity obligations
• C.Through the Risk Assessment category, it ensures the organization identifies and scores its threats, vulnerabilities, likelihood estimates, and potential business impacts across each system
• D.Through the Business Environment category, it ensures the organization documents and prioritizes its mission, stakeholders, dependencies, and supply chain role across each function