When aligning an organization's information security program with other risk and control activities, it is MOST important to:

A. develop an information security governance framework.
B. have information security management report to the chief risk officer.
C. ensure adequate financial resources are available.
D. integrate security within the system development life cycle.