The correct answer is C because effective information security governance enables management to make informed decisions about risk, resources, priorities, investments, and control requirements. Governance establishes accountability, reporting structures, policies, metrics, risk oversight, and alignment with enterprise objectives. Prioritization of security projects is a benefit, but it is only one outcome of informed governance.
Alignment with compliance requirements is also important, but governance is broader than compliance alone.
Information security risk avoidance is not generally the objective because not all risk can or should be avoided; risk may be mitigated, transferred, accepted, or avoided depending on business context. CISM emphasizes that governance ensures information security supports business objectives and provides value through risk-informed decision-making. Senior management needs accurate, relevant, and timely information to decide how much risk to accept and where to allocate resources. Therefore, the key benefit of effective information security governance is improved and informed decision-making.
Reference: CISM Information Security Governance; governance outcomes, decision-making, risk oversight, and business alignment principles.