Which of the following is MOST important for an IS auditor to consider when auditing a vulnerability scanning software solution?

A. The scanning software was purchased from an approved vendor.
B. The scanning software was approved for release into production.
C. The scanning software covers critical systems.
D. The scanning software is cost-effective.