Which of the following messages would be MOST effective in obtaining senior management’s commitment to information security management?

A. Effective security eliminates risk to the business
B. Adopt a recognized framework with metrics
C. Security is a business product and not a process
D. Security supports and protects the business