Which of the following is MOST important when selecting an information security metric?