问题：

[多选] What are two important approaches to communicate when identifying a customer’s security risks？ （Choose two.） （）

A .  Smaller companies are at less risk than larger enterprises， so their security needs are not as great.
B .  Business strategy should directly relate to the security policy and budget.
C .  The designated security expert should report to the IT department， since that is where thesolution will be implemented.
D .  Security should be a continuous process.
E .  Security solutions should come from multiple vendors to make it easier to coordinate security events from the point of origin.