Which of the following policies would help an organization identify and mitigate potential single points of failure in the company’s IT/security operations?