During a vulnerability assessment, an IS auditor finds a high-risk vulnerability in a public-facing web server used to process online customer orders via credit card. The IS auditor should FIRST:

A. notify management.
B. redesign the customer order process.
C. document the finding in the report.
D. suspend credit card processing.