An auditor finds that one branch office stored decommissioned drives without sanitizing them, breaching the media disposal procedure. After correcting that branch, Clause 10.2(b) prompts a specific evaluation. Which action does it require?

• A.Notify the certification body of the unsanitized drives at the branch office before the next surveillance audit takes place
• B.Replace the disposal vendor used by the branch office with a certified shredding provider chosen by the procurement team for the whole group
• C.Update the media disposal procedure to name the branch manager the owner of the sanitization checklist for drives kept in the branch office
• D.Determine whether the same unsanitized-disposal nonconformity exists or could occur at the organization's other offices