Which of the following is the BEST approach for encouraging business units to assume their roles and responsibilities in an information security program?

Engaging an independent security audit evaluates existing controls but does not inherently encourage business units to proactively assume new responsibilities.

Performing a risk assessment identifies potential threats and vulnerabilities but doesn't directly motivate business units to proactively embrace their security roles.

An awareness program targeting senior management is crucial because their understanding and visible support are vital for cascading security responsibilities and fostering a security-conscious culture throughout the organization. When leadership champions information security, it provides the necessary authority and resources for business units to embrace their roles.

Developing controls and countermeasures provides the technical safeguards, but without business unit ownership and understanding, these may not be effectively implemented or sustained.