The MOST important outcome of information security governance is: