The head of a business operations department asks to review the entire IT risk register. Which of the following would be the risk manager’s BEST approach to this request before sharing the register?

A. Determine the purpose of the request.
B. Require a nondisclosure agreement.
C. Sanitize portions of the register.
D. Escalate to senior management.