An information security program is being developed for a multinational organization. Which of the following is the PRIMARY driver for aligning the security program with business objectives?