Which of the following would MOST effectively ensure that information security is implemented in a new system?

A. Security baselines
B. Security scanning
C. Secure code reviews
D. Penetration testing