In configuration management and control, if necessary, updates have to be made to which of the following documents?
a. System security plan
b. System security plan and plan of action and milestones
c. Plan of action and milestones
d. System deficiency report and plan of action and milestones