Which of the following is MOST likely to drive an update to the information security strategy?

A. A recent penetration test has uncovered a control weakness.
B. A major business application has been upgraded.
C. Management has decided to implement an emerging technology.
D. A new chief technology officer has been hired.