An organization outsources its payroll processing. Which of the following would be the BEST key risk indicator for monitoring the information security of the service provider?

A. Number of security incidents by severity
B. Number of critical security patches
C. Percentage of application up-time
D. Number of manual payroll adjustments