Malware has recently affected an organization. The MOST effective way to resolve this situation and define a comprehensive risk treatment plan would be to perform:

A. a vulnerability assessment.
B. a root cause analysis.
C. an impact assessment.
D. a gap analysis.