A company wants to quantify and communicate the effectiveness of its security controls but must establish measures. Which of the following is MOST likely to be...