An information security manager determines there are a significant number of exceptions to a newly released industry-required security standard. Which of the fo...