According to IIA guidance, which of the following is a primary component of a network security strategy?