Which of the following is the BEST way for an organization that outsources many business processes to gain assurance that services provided are adequately secured?

A. Review the service providers’ information security policies and procedures.
B. Conduct regular vulnerability assessments on the service providers’ IT systems.
C. Perform regular audits on the service providers’ applicable controls.
D. Provide information security awareness training to service provider staff.