Which of the following processes would BEST aid an information security manager in resolving systemic security issues?

A. Root cause analysis
B. Business impact analysis (BIA)
C. Reinforced security controls
D. Security reviews