Choice "C" is correct. The objective of data security controls is to ensure that storage media are only accessed, changed, or deleted after appropriate authorization. The objective is to protect information.
Choice "b" is incorrect. Polices establish an overall approach to computer security and are sometimes referred to as the IT security strategy. Data security controls are designed to protect information, not to establish strategy or policy.
Choice "a" is incorrect. Policy support documents, such as procedures, formalize standards, rules, and procedures to ensure the organization's controls are properly executed. Data security controls may be included in procedures, but development of procedures is not their objective.
Choice "d" is incorrect. Change management and related control activities anticipate monitoring the use of system software to prevent unauthorized access to system software and computer programs.