Which of the following has the GREATEST impact on the implementation of an information security governance model?