Which of the following provides the MOST relevant information to determine the overall effectiveness of an information security program and underlying business processes?