When making an outsourcing decision, which of the following functions is MOST important to retain within the organization?

A. Security management
B. Incident response
C. Risk assessment
D. Security governance