A board receives only a count of high risks. What additional information best supports its decisions?

1. Business impact, concentration, trends, treatment status, and decisions required
2. Every raw vulnerability record without grouping
3. A longer list of technical acronyms
4. Only the number of staff who attended risk meetings