Which of the following is the BEST approach for determining the maturity level of an information security program?