In implementing information security governance, the information security manager is PRIMARILY responsible for: