Ensuring that an organization can conduct security reviews within third-party facilities is PRIMARILY enabled by:

A. service level agreements (SLAs)
B. acceptance of the organization’s security policies
C. contractual agreements
D. audit guidelines