The system administrator has deployed updated security controls for the network to limit risk
of attack. The security manager is concerned that controls continue to function as intended
to maintain appropriate security posture. Which of the following risk mitigation strategies is
MOST important to the security manager?

A.
User permissions

B.
Policy enforcement

C.
Routine audits

D.
Change management