The selection of security controls is PRIMARILY linked to: