An IS auditor notes that a number of application plug-ins currently in use are no longer supported. Which of the following is the auditor’s BEST recommendation to management?

A. Implement role-based access controls.
B. Conduct a vulnerability assessment to determine exposure.
C. Review content backup and archiving procedures.
D. Review on-boarding and off-boarding processes.