Which of the following should be made part of a proprietary. information protection program?