The PRIMARY purpose of implementing information security governance metrics is to:

A. measure alignment with best practices.
B. assess operational and program metrics.
C. refine control operations,
D. guide security towards the desired state.