How many of the STEPS of the Risk Management Framework AMF contain "Information System," and how many contain "Security Controls," e.g. Categorize Information System, or Monitor Security Controls?
a. Information System-2, Security Controls-4
b. Information System-3, Security Controls-3
c. Information System-4, Security Controls-3
d. Information System-4, Security Controls-2