An organization is considering the purchase of a competitor. To determine the competitor's security posture, the BEST course of action for the organization's information security manager would be to:

A. assess the security policy of the competitor.
B. assess the key technical controls of the competitor.
C. conduct a penetration test of the competitor.
D. perform a security gap analysis on the competitor.