Which of the following BEST indicates that information security governance and corporate governance are integrated?

While awareness of business goals by the security team is good, it doesn't necessarily mean security is integrated into corporate governance at the highest levels.

Conducting a cost-benefit analysis is a sound financial practice, but it's a tactical step rather than an indicator of strategic, integrated governance.

Informing the board of KPIs is a reporting mechanism, indicating oversight, but doesn't, by itself, demonstrate deep integration into the decision-making and strategic planning processes.

When an information security steering committee is composed of business leaders from various departments, it signifies that information security is viewed as a strategic business concern, not just an IT function. This integration ensures that security initiatives are aligned with overarching corporate goals, risks are assessed from a business perspective, and security decisions receive top-level support and resources.