An information security manager has been asked to provide regular status reports to senior management regarding the information security program. Which of the f...