An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information s...