A regional business unit of a major financial institution is considering the use of a Software as a Service (SaaS) cloud vendor to implement a new system. Which of the following should be performed FIRST?

A. Update the outsourcing policy.
B. Investigate on-premise software solutions.
C. Develop a business case.
D. Determine if the cloud vendor has a secure data center.