Which of the following BEST demonstrates the maturity of an information security monitoring program?

A. Senior management regularly reviews security standards.
B. The information security program was introduced with a thorough business case.
C. Information security key risk indicators (KRIs) are tied to business operations.
D. Risk scenarios are regularly entered into a risk register.