Which of the following is the MOST effective way to determine the alignment of an information security program with the business strategy?

Evaluating business continuity testing results assesses resilience, but not necessarily the overall strategic alignment of the security program with everyday business goals.

Evaluating the business impact of incidents is a reactive measure for assessing past failures, not a proactive way to ensure strategic alignment of the program.

Reviewing key performance indicators (KPIs) can show progress or effectiveness, but KPIs must first be defined to reflect strategic alignment, which is best done by engaging process owners.

Engaging business process owners is the most effective way to ensure alignment because these individuals understand the critical operations, objectives, and risks of their specific business units. Their direct input helps tailor security controls and priorities to genuinely support and protect the core business functions, ensuring the security program directly contributes to business strategy.