Which of the following is the MOST important consideration for designing an effective information security governance framework?