How should significant changes to a facility's security posture be managed and communicated?

• A. Through informal, adhoc updates.
• B. Through a formal change management process: risk assessment, approvals, documentation, SOP updates, training, and stakeholder communication.
• C. By delaying all changes indefinitely.
• D. Only the security team needs to be informed, not stakeholders.

Answer: (B)