An organization is planning to host a number of its critical applications in the cloud. Which of the following is the
Best way to gain a broad assurance of the cloud provider’s security posture?

A.
A review that includes interviewing key security stakeholders and identifying the key controls that they
operate.

B.
A review that includes security policies, evidence of the controls, physical site assessments and vulnerability
scanning.

C.
A review that includes the right to audit on a yearly basis and review of the security clauses in the contract.

D.
A review that includes security applications, external audits, intrusion detection and firewall policy reviews.