what are the three fundamental elements of an effective security program for information systems?