Which of the following is not true?A. An organization may express its cybersecurity state through a Current Profile to report results or to compare with acquisition requirements. B. Only critical infrastructure agencies may establish a Target Profile that can be used among their constituents as an initial baseline Profile to build their tailored Target Profiles. C. An organization may utilize a Target Profile to express cybersecurity risk management requirements to an external service provider (for example, a cloud provider to which it is exporting data).D. A critical infrastructure owner/operator, having identified an external partner on whom that infrastructure depends, may use a Target Profile to convey required categories and subcategories.