Which of the following is the MOST important prerequisite to performing an information security assessment?