Which of the following provides the BEST evidence of an IT risk-aware culture across an enterprise?

When business staff proactively identify and report IT risks, it demonstrates that risk awareness has permeated beyond the IT department and is embedded into the daily operations and responsibilities of the wider organization. This indicates a mature, enterprise-wide risk-aware culture where risk management is a shared responsibility.

Communicating IT risks to the business is a necessary step, but it doesn't inherently prove that the business itself has adopted a proactive, risk-aware mindset to identify new risks independently.

Publishing IT risk-related policies provides a framework and guidelines, but policies alone do not guarantee their active understanding and application in fostering a proactive risk-aware culture.

A resilient IT infrastructure is a positive outcome of effective risk management, but it is a technical state rather than direct evidence of the human element of a risk-aware culture across the enterprise.