The risk associated with a high-risk vulnerability in an application is owned by the:

A. security department.
B. vendor.
C. business unit.
D. IT department.