CCM: A hypothetical start-up company called "ABC" provides a cloud based IT management solution.

Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations, infrastructure network and systems components.

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned ormanaged user end-point devices (e.g. issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

None of the above