The best indication of an effective information security program is that risks are managed to an acceptable level based on the organization's risk appetite. This ensures that security efforts are aligned with business objectives, compliance requirements, and threat landscapes. While policy reviews, KRIs, and increased incident reporting are valuable, they do not directly measure the overall effectiveness of the security program like proper risk treatment does.