Which of the following is the MOST important factor when determining the frequency of information security risk reassessment?