During an audit of an access control system, an IS auditor finds that RFID card readers are not connected via the network to a central server. Which of the following is the GREATEST risk associated with this finding? 

Answer options:

A. Lost or stolen cards cannot be disabled immediately.
B. Card reader firmware updates cannot be rolled out automatically.
C. The system is not easily scalable to accommodate a new device.
D. Incidents cannot be investigated without a centralized log file.

D