Penetration testing is MOST appropriate when a:

A. new system is about to go live.
B. security incident has occurred.
C. security policy is being developed.
D. new system is being designed.