When an information security manager presents an information security program status report to senior management, the MAIN focus should be: