Auditors found 400 active accounts for contractors whose engagements ended. Forty agencies supply staff, nobody owns their access lifecycle, and the business wants contractor single sign-on next quarter. What should the security manager do FIRST? A. Disable the 400 accounts and notify the agencies B. Assign an owner and define the contractor access lifecycle C. Extend single sign-on with mandatory MFA to contractors D. Schedule quarterly access reviews for contractors (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!