Which of the following is a desired outcome of information security governance?

Which of the following is MOST important to have in place as a basis for developing an effective information security program that supports the organization's business goals?

Which of the following methods is the BEST way to demonstrate that an information security program provides appropriate coverage?