An internal auditor asks the information security manager for evidence that the security program supports the organization's information security strategy. Which evidence would BEST demonstrate this?

Alignment between a program and a strategy is shown through traceability: each program objective and initiative should be linked to the strategic objective it advances, ideally with measures that show progress. Such a mapping lets an auditor or executive see why each activity exists, identify initiatives that serve no strategic purpose and spot strategic objectives that lack program support. Budget growth in line with revenue shows how much the organization spends, not whether the spending serves the strategy; a program can grow while pursuing the wrong priorities. Adopted frameworks and their control counts describe the program's reference structure, but frameworks are generic and say nothing about the specific strategic objectives of this organization. On-time, on-budget delivery demonstrates project management efficiency, which is useful, yet projects can be delivered perfectly while contributing nothing to the strategy if they were poorly chosen. Exam caveat: performance and efficiency evidence complements alignment evidence but cannot substitute for it. Operational check: confirm the program plan contains a traceability matrix in which every initiative references a strategic objective and every strategic objective has at least one supporting initiative with a measure.