Who does the security auditor report to?

A.
Data owners

B.
Data custodians

C.
External audit organization

D.
Senior management

Explanation:
The security auditor is responsible for reporting to senior management
about the effectiveness of security controls and their compliance with security
policy objectives.