Which of the following issues identified during a formal review of an organization's information security...

The policies are not available to key risk stakeholders.

The policies have not been reviewed by the risk management committee.

The policies are not aligned with the information security risk appetite.

The policies are not based on industry best practices for information security.