Which of the following is the MOST important component of information security governance?

A. Approved Information security strategy
B. Documented information security policies
C. Comprehensive information security awareness program
D. Appropriate information security metrics