The best indication of a mature information security program is that information security functions are integrated throughout the business. This integration indicates that security is not just a standalone function but is embedded in all aspects of the organization, including operations, processes, and culture.
While approval from business owners, support from senior management, and inclusion in the application development process are important factors, the comprehensive integration of security across the organization reflects a higher level of maturity and commitment to protecting information assets.