The correct answer is D because adequate funding demonstrates that senior management is actively supporting the information security strategy with the resources required for implementation and sustainability. A strategy cannot be effective unless it is backed by budget, staffing, tools, training, governance support, and operational capability. Key performance indicators help measure progress, but they do not by themselves prove management commitment. A comprehensive awareness program is valuable, but it may exist without broad strategic support. An efficient incident response program is important, but it represents one part of the overall security program. In CISM, senior management commitment is reflected through sponsorship, direction, resource allocation, accountability, and continuous support. Funding is especially important because it enables security initiatives to be executed and maintained over time. Without adequate resources, even a well-designed strategy may fail. Therefore, adequate funding for the information security program is the best indicator of ongoing senior management commitment.