Which of the following metrics would provide an accurate measure of an information security program's...

A collection of qualitative indicators that accurately measure security exceptions

A combination of qualitative and quantitative trends that enable decision making

A collection of quantitative indicators that are compared against industry benchmarks

A single numeric score derived from various measures assigned to the security program