The correct answer is D because business leadership needs security reporting that explains how the security program supports business objectives, risk management, compliance, resilience, and value delivery. Linking security to business strategy enables leadership to understand whether security investments and initiatives are helping the organization achieve its goals. Comprehensive security statistics may be too technical or operational unless translated into business impact. Industry benchmarks can provide useful context, but they do not necessarily reflect the organization's specific strategy, risk appetite, or priorities. Security audit results by line of business may help with accountability, but they are still only one source of assurance. CISM governance principles emphasize that security must be aligned with enterprise objectives and communicated in business-relevant terms. Effective reporting should support informed decision-making, prioritization, funding, and oversight. Therefore, the most effective approach is to connect the security program directly to business strategy.
Reference: CISM Information Security Governance; strategic alignment, business-focused reporting, governance metrics, and value delivery principles.