Under the Red Flags Rule, all covered financial institutions and creditors must implement what type of plan?
a) Risk mitigation plan
b) Identity theft prevention plan
c) Fraud detection plan
d) Security breach response plan