Which of the following BEST enables an information security manager to determine the comprehensiveness of an organization’s information security strategy?

A. Business impact analysis
B. Organizational risk appetite
C. Independent security audit
D. Security risk assessment