Which of the following BEST demonstrates that an organization supports information security governance?

A. Employees attend annual organization-wide security training.
B. Information security policies are readily available to employees.
C. The incident response plan is documented and tested regularly.
D. Information security steering committee meetings are held regularly.