Which of the following is MOST important for the information security manager to include when presenting changes in the security risk profile to senior manageme...