Which of the following is MOST relevant for an information security manager to communicate to IT operations?