A company's recent audit noted a lack of centralized cybersecurity decision-making. As a result, the Chief Information Security Officer (CISO) established an IT steering committee to evaluate changes in the security governance program. Which of the following artifacts is BEST suited to demonstrate remediation of the audit finding?

A. Quarterly executive briefing notes

B. Security-control gap-analysis report

C. Corporate risk register

D. Steering committee meeting minutes