Senior management has approved employees working off-site by using a virtual private network (VPN) connection. It is MOST important for the information security manager to periodically:

A. perform a cost-benefit analysis
B. review firewall configuration
C. review the security policy
D. perform a risk assessment