Control self-assessments (CSAs) (D) best provide an understanding of the effectiveness of an organization’s information security program because they focus specifically on whether security controls are operating as intended on an ongoing basis. In CISM, program effectiveness is measured not only by design adequacy, but by consistent execution and performance of controls across the organization.

CSAs enable control owners and business stakeholders to evaluate control implementation, identify weaknesses, and report effectiveness in a structured and repeatable manner. This provides management with broad, timely, and actionable insight into how well the security program is functioning day to day. Internal audits (B) offer independent assurance but are typically periodic and retrospective. Enterprise risk assessments (C) focus on identifying and prioritizing risks, not on validating control performance. Security spot checks (A) are limited in scope and do not provide a comprehensive program view.

CISM emphasizes that effective security programs rely on continuous monitoring and self-assessment mechanisms to demonstrate control effectiveness, support improvement, and inform governance reporting.