The PRIMARY goal of information security governance to an organization is to: