Which of the following provides the BEST evidence of an IT risk-aware culture across an enterprise?

A. The IT infrastructure is resilient.
B. IT risks are communicated to the business.
C. Business staff report identified IT risks.
D. IT risk-related policies are published.