A. The security audit is measured against a known standard.

B. The security audit is performed by a certified internal auditor.

C. The security audit is performed by an independent third-party.

D. The security audit produces reporting metrics for senior leadership.