The best evidence that the information security program is aligned to the business strategy is that information security initiatives are directly correlated to business processes. This shows that security efforts are focused on protecting and supporting critical business functions, ensuring that security aligns with and enables business objectives.
While risk tolerance, meeting the CISO's expectations, and providing KPIs are important, the direct alignment of security initiatives with business processes is the clearest indication that the security program is supporting the overall business strategy.