What best describes the ultimate goal of having proper security management systems and processes in an organization?