A. Establishing security policies and standards, testing Business Continuity Plans
B. Establishing business context for security, detecting and responding to attacks
C. Developing Plans of Action & Milestones, managing Crisis Events
D. Identifying and meeting regulatory obligations, defining and implementing policies and standards
Explanation:
Reference: https://community.rsa.com/docs/DOC-43148