Which of the following is the BEST way for an information security manager to justify continued investment in the information security program when the organization is facing significant budget cuts?

A. Demonstrate an increase in ransomware attacks targeting peer organizations.
B. Demonstrate the readiness of business continuity plans.
C. Demonstrate that implemented program controls are effective.
D. Demonstrate that the program enables business activities.