Senior management asks the information security manager for justification before approving the acquisition of a new intrusion detection system (IDS). The BEST course of action is to provide:

A. documented industry best practices
B. a gap analysis against the new IDS controls.
C. a business case.
D. a business impact analysis (BIA).