Which of the following is MOST useful when developing a business case for security initiatives?