Which of the following is the BEST way to prevent recurrence of a security incident?

A. Review and update security policy on a regular basis
B. Management support and approval of the incident response plan
C. An appropriate investigation into the root cause with corrective measures applied
D. An expanded and more effective monitoring and detection process for incidents