Definition: In this task, you're given a statement and three sentences as choices. Your job is to determine which sentence can be inferred from the statement. Incorrect choices change the meaning in important ways or have details that are not mentioned in the statement. Indicate your answer as 1,2, or 3 corresponding to the choice number of the selected sentence.
Input: Statement: In this regard, agencies must continually (1) explore and assess information security risks to business operations, (2) determine what policies, standards, and controls are worth implementing to reduce these risks, (3) promote awareness and understanding among program managers, computer users, and systems development staff, and Choices:  1. Agencies have to find ways to reduce these risks, either by implementing some kind of policies, by promoting awareness and by assessing the security risks present in their business operations. 2. There is no risk to business operations, so no reason to try and asses or control them. 3. There is no real way to control the risks 100% but there always will be ways to help diminish them.

1