Which of the following would the BEST demonstrate the added value of an information security program?

A. Security baselines
B. A SWOT analysis
C. A gap analysis
D. A balanced scorecard