Which of the following metrics would provide management with the MOST useful information about the effectiveness of a security awareness program?

A. Increased number of downloads of the organization's security policy
B. Decreased number of security incidents
C. Increased number of reported security incidents
D. Decreased number of phishing attacks