Senior management has approved employees working off-site by using a virtual private network (VPN) connection. It is MOST important for the information security manager to periodically:

A. perform a cost-benefit analysis

B. review firewall configuration

C. review the security policy

D. perform a risk assessment