Watch this video on YouTube
When evaluating the need for additional staffing in an information security program, what should be prioritized to ensure program effectiveness?