A Department Within Your Company Has Proposed a Third Party

A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:

A) Vendor's client list of reputable organizations currently using their solution
B) Vendor provided attestation of the detailed security controls from a reputable accounting firm
C) Vendor provided reference from an existing reputable client detailing their implementation
D) Vendor provided internal risk assessment and security control documentation