Which of the following is the PRIMARY purpose of establishing an information security governance framework?