An IS auditor is reviewing an industrial control system (ICS) that uses older unsupported technology in the scope of an upcoming audit. What should the auditor consider the MOST significant concern? 

Answer options:

A. Technical specifications are not documented.
B. Disaster recovery plans (DRPs) are not in place.
C. Attack vectors are evolving for industrial control systems.
D. There is a greater risk of system exploitation.

D