When considering the organization's overall security program, which of the following should be fully committed to the security process?