Which of the following is the BEST evidence of the maturity of an organization’s information security program?

A. The number of reported incidents has increased.
B. The information security department actively monitors security operations.
C. The number of reported incidents has decreased.
D. IT security staff implements strict technical security controls.