When developing a business case to justify an information security investment, which of the following would BEST enable an informed decision by senior management?

An information security strategy outlines overarching goals but lacks the specific, quantifiable risk data needed to justify a particular investment.

Security investment trends in the industry offer general context but do not reflect the organization's unique risk posture or provide justification for its specific investment needs.

While past losses due to security incidents are relevant, they are reactive and provide only historical data, whereas a comprehensive risk assessment offers a proactive view of all potential future risks and impacts.

The results of a risk assessment provide an objective and data-driven view of potential threats, vulnerabilities, likelihood, and impact, enabling senior management to understand the tangible risks and benefits associated with security investments. This includes quantifying potential losses and comparing them against the cost of mitigation.