Senior management has approved employees working off-site by using a virtual private network (VPN) connection. It is MOST important for the information security manager to periodically:

A. review firewall configuration
B. review the security policy
C. perform a cost-benefit analysis
D. perform a risk assessment