Which of the following MUST be done when promoting a security awareness program to senior management?