When establishing an information security governance framework, it is MOST important for an information security manager to understand: