In an effort to reduce operation costs, an enterprise is switching from all internally-hosted applications to a mixture of internally- and externally-hosted applications. Of the following, the risk appetite for this decision would BEST be defined by the:

A. vendor oversight committee.
B. board of directors.
C. chief information security officer.
D. chief information officer.