When establishing an information security governance framework, it is MOST important for an information security manager to understand:

A. the regulatory environment.
B. information security best practices.
C. the corporate culture.
D. risk management techniques.