Which of the following should be of MOST influence to an information security manager when developing IT security policies?

A. Past and current threats
B. IT security framework
C. Compliance with regulations
D. Business strategy