Which of the following is MOST important when establishing a successful information security governance framework?

A. Selecting information security steering committee members
B. Developing an information security strategy
C. Determining balanced scorecard metrics for information security
D. Identifying information security risk scenarios