When outsourcing information security administration, it is MOST important for an organization to include: