An organization was fined due to an audit finding that revealed a third-party vendor was able to see secured project information in a recently implemented system. Which of the following was the cause of this situation?

A. The ticket system provided access by default without any approval.

B. The project manager did not perform proper project planning.

C. The system is lacking proper access controls.

D. Sensitive data was incorrectly classified during the audit process.