Which of the following is the BEST way to demonstrate to senior management that organizational security practices comply with industry standards?

A. Results of an independent assessment
B. Up-to-date policy and procedures documentation
C. A report on the maturity of controls
D. Existence of an industry-accepted framework