The potential risks to the confidentiality of the accounting records is the most critical factor when selecting and adapting security controls for this application.

A risk based approach starts with identifying the specific confidentiality threats and impacts to those accounting records and then selects controls that directly reduce the highest likelihood and highest impact scenarios. Focusing on confidentiality risk ensures that technical, administrative, and physical controls are proportionate to the sensitivity of the data and the real threats the application will face.

Industry standards and established best practices for security controls are useful as guidance and baseline controls but they must be adapted to the actual risks and data classification for the application, so they are not the single most critical factor.

Regulatory and compliance obligations that apply to the organization set minimum required controls in many cases but compliance alone does not guarantee protection of confidentiality and may not cover all risks specific to the accounting records.

Budgetary and staffing constraints of the company affect feasibility and implementation timing and they must be considered when planning, but they do not determine which controls are most appropriate from a security perspective.

Full AWS Practitioner Certification Question