The PRIMARY reason for using information security metrics is to:

A. achieve senior management commitment.
B. ensure alignment with corporate requirements.
C. adhere to legal and regulatory requirements.
D. monitor the effectiveness of controls.