An IS auditor reviewing an incident management process identifies client information was lost due to ransomware attacks. Which of the following would MOST effectively minimize the impact of future occurrences?

A. Change access to client data to read-only.
B. Improve the ransomware awareness program.
C. Back up client data more frequently.
D. Monitor all client data changes.