Who should be accountable for ensuring effective cybersecurity controls are established?

A. Security management function
B. Enterprise risk function
C. Risk owner
D. IT management