An information security program should be sponsored by:

infrastructure management. 

the corporate audit department.

key business process owners.

information security management.