What is the BEST indicator of successful implementation of an organization’s information security policy?

A. Reduced number of successful phishing incidents
B. Reduced number of help desk calls
C. Reduced number of noncompliance penalties incurred
D. Reduced number of false-positive security events