Which of the following provides the BEST evidence that the information security program is aligned to the business strategy?

A. The information security program manages risk within the business's risk tolerance.
B. The information security team is able to provide key performance indicators (KPIs) to senior management.
C. Business senior management supports the information security policies.
D. Information security initiatives are directly correlated to business processes.