When developing a business case to justify an information security investment, which of the following would BEST enable an informed decision by senior managemen...