An organization is within a jurisdiction where new regulations have recently been announced to restrict cross-border data transfer of personally identifiable information (PII). Which of the following IT decisions will MOST likely need to be assessed in the context of this change?

A. Hosting the payroll system at an external cloud service provider
B. Purchasing cyber insurance from an overseas insurance company
C. Applying encryption to database hosting PII data
D. Hiring IT consultants from overseas