Why might you need to verify risk elements if a substantial amount of time has passed since you performed a risk assessment?
(a) to ensure compliance with regulations and laws that affect your organization
(b) to make sure that the threats or vulnerabilities you want to mitigate still exist
(c) to protect servers and databases
(d) to maximize the cost-effectiveness of your mitigation plan