A financial services firm is finalizing its enterprise information security program. The CISO has drafted a set of security policies, but the board's audit committee returns them with feedback that the documents fail to demonstrate how security priorities support the organization's three-year strategic plan to expand into digital lending. The CISO must revise the governance approach. Which action BEST addresses the committee's concern about aligning security to business objectives?