Which of the following would BEST help to ensure an organization’s security program is aligned with business objectives?

A. Security policies are reviewed and approved by the chief information officer.
B. The security strategy is reviewed and approved by the organization’s executive committee.
C. The organization’s board of directors includes a dedicated information security specialist.
D. Project managers receive annual information security awareness training.