Which of the following processes evaluates the adherence of an organization to its stated security policy?

A.
Vulnerability assessment

B.
Penetration testing

C.
Risk assessment

D.
Security auditing