A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the...