Which of the following is the PRIMARY responsibility of an information security governance committee?

Reviewing the risk register is an important task, but it's often delegated or a more operational/tactical review rather than the committee's primary, overarching strategic responsibility.

A governance committee operates at a strategic level, setting the direction and ensuring that the information security strategy aligns with the organization's mission, vision, and risk tolerance. Approving strategic changes ensures that security efforts are always in lockstep with business priorities and regulatory requirements.

Discussing upcoming projects falls more into the realm of project management or operational planning, not the highest-level strategic governance of the entire program.

Reviewing monthly metrics is an oversight activity to gauge program performance, but the primary role of governance is to establish and adjust the strategy that those metrics measure.