An information security manager is concerned that executive management does not support information security initiatives.
Which of the following is the BEST way to address this situation?
A . Report the risk and status of the information security program to the board
B . Revise the information security strategy to meet executive management’s expectations
C . Escalate noncompliance concerns to the internal audit manager
D . Demonstrate alignment of the information security function with business needs
Answer: D