In the context of SSP certification, what is the most important consideration when implementing regulatory investigation & response?