Which of the following is the MOST important consideration for designing an effective information security governance framework?

A. Defined security metrics
B. Continuous audit cycle
C. Security policy provisions
D. Security controls automation