Which of the following BEST enables an information security manager to demonstrate the effectiveness of the information security and risk program to senior mana...