An administrator would like to review the effectiveness of existing security in the enterprise. Which of the following would be the BEST place to start?