An organization has outsourced its data leakage monitoring to an Internet service provider (ISP). Which of the following is the BEST way for an IS auditor to determine the effectiveness of this service?

A. Verify the ISP has staff to deal with data leakage
B. Review the ISP’s external audit report
C. Review the data leakage clause in the SLA
D. Simulate a data leakage incident