An enterprise wants to address the human factors of social engineering risk within the organization. From a governance perspective, which of the following is the BEST way to mitigate this risk?

A. Mandate security requirements be included in employee contracts.
B. Distribute the social media information security policy to staff.
C. Mandate annual security awareness training.
D. Restrict access to social media.