Which of the following is the MOST important outcome of a well-implemented awareness program?

A. The board is held accountable for risk management.
B. The number of reported security incidents steadily decreases.
C. The number of successful social engineering attacks is reduced.
D. Help desk response time to resolve incidents is improved.