An IS auditor notes that a number of application plug-ins currently in use are no longer supported. Which of the following is the auditor`s BEST recommendation to management? 

Answer options:

A. Implement role-based access controls.
B. Conduct a vulnerability assessment to determine exposure.
C. Review content backup and archiving procedures.
D. Review on-boarding and off-boarding processes.

B