Which of the following is the BEST way for an information security manager to justify continued investment in the information security program when the organization is facing significant budget cuts?

A. Demonstrate that the program enables business activities
B. Demonstrate an increase in ransomware attacks targeting peer organizations
C. Demonstrate that implemented program controls are effective
D. Demonstrate the readiness of business continuity plans