A risk practitioner recently discovered that sensitive data from the production environment is required for testing purposes in non-production environments. Which of the following is the BEST recommendation to address this situation?

A. Mask data before being transferred to the test environment.
B. Implement equivalent security in the test environment.
C. Enable data encryption in the test environment.
D. Prevent the use of production data for test purposes.