Which of the following is a common element of the enterprise information security policy?