Which of the following provides the BEST indication that the information security program is in alignment with enterprise requirements?

The security strategy is benchmarked with similar organizations. 

The information security manager reports to the chief executive officer. 

Security strategy objectives are defined in business terms. 

An IT governance committee is in place.