The best answer is D. Maturity model.

ISACA states that maturity models are becoming the common language used by organizations to understand the current state of their COBIT implementations and to support gap analysis and road maps for improvement. That is exactly what this question asks: measuring the current state of IT processes against leading practices.

Option A provides direction, but policies do not measure current state. Option B can provide comparison with peers, but benchmarking is not the primary mechanism for assessing process capability or maturity against good practice levels. Option C provides structure for controls, but a control framework alone does not inherently measure present maturity. A maturity model is the specific tool for assessing where the organization currently stands and how far it is from desired practice levels.

References (Official ISACA):

ISACA Journal, Building a Maturity Model for COBIT 2019 Based on CMMI.

ISACA Journal, A Holistic Approach to Controls, Risk and Maturity.

ISACA, Effective Capability and Maturity Assessment Using COBIT 2019.