Which of the following is MOST critical to the successful implementation of information security within an organization?

A. Strong risk management skills exist within the information security group.
B. Budget is allocated for information security tools.
C. The information security manager is responsible for setting information security policy.
D. Security is effectively marketed to all managers and employees.