The correct answer is B because the primary objective of testing security controls in critical infrastructure is to ensure that IT services remain secure, resilient, and available. Critical infrastructure supports essential business, public, or operational services, so control failures may have severe consequences. Testing verifies whether controls are designed and operating effectively, whether they reduce risk as intended, and whether they support continuity of critical services. Identifying security team performance issues may be a secondary outcome of testing, but it is not the primary objective. Reducing failed deployments is useful for operational quality, but security control testing focuses on assurance and resilience rather than deployment statistics.
Reducing the number of assessments may save resources, but fewer assessments do not necessarily improve security. In CISM program management, controls must be monitored and tested to ensure they continue to meet control objectives and support business requirements. For critical infrastructure, resilience and security of services are the central goals.
Reference: CISM Information Security Program Development and Management; control testing, critical infrastructure protection, resilience, and service security principles.