Which of the following is the BEST justification to convince management to invest in an
information security program?

A.
Cost reduction

B.
Compliance with company policies

C.
Protection of business assets

D.
Increased business value

Explanation:

Investing in an information security program should increase business value and confidence. Cost
reduction by itself is rarely the motivator for implementing an information security program.
Compliance is secondary to business value. Increasing business value may include protection of
business assets.