Which of the following is the BEST approach for determining the maturity level of an information security program? 

Answer options:

A. Review internal audit results.
B. Engage a third-party review.
C. Perform a self-assessment.
D. Evaluate key performance indicators (KPIs).

D