Which of the following is the MOST appropriate board-level activity for information security governance?

A. Establish security and continuity ownership

B. Develop -what-if- scenarios on incidents

C. Establish measures for security baselines

D. Include security in job-performance appraisals