An organization should document its IT control framework for the following: Compliance with applicable regulations and legislation Consistency with the organization's goals and objectives Reliable evidence that activities comply with management's governance policies and are consistent with the organization's risk appetite A. 1 and 3 only. B. 2 and 3 only. C. 1 only. D. 1, 2, and 3 only