Which of the following provides the MOST comprehensive understanding of an organization’s information security posture?

A. Risk management metrics
B. External audit findings
C. Results of vulnerability assessments
D. The organization’s security incident trends