Which of the following should be of MOST influence to an information security manager when developing IT security policies?