Achief information security officer (ciso) needs to establish a kri for a particular system. the system holds archives of contracts that are no longer in use. the contracts contain intellectual property and have a data classification of non-public. which of the following be the best risk indicator for this system?

(a) average minutes of downtime per quarter
(b) percent of patches applied in the past 30 days
(c) count of login failures per week
(d) number of accounts accessing the system per day