Security is a business unit and its function must:

Security is not a standalone function; it must align with and support the broader mission and strategic goals of the organization. This includes protecting assets, enabling business continuity, and ensuring safety in a way that complements business objectives.

A (Quarterly cycle) is not a standard requirement.

B (Certified manager) is good practice but not a defining mandate.

D (Lowest cost) is not always ideal; effectiveness and alignment are more important than minimal cost.