A network administrator is deploying posture services with the Cisco Secure Client (AnyConnect) posture module on corporate Windows endpoints. During client provisioning, users report that although the Secure Client posture module installs successfully, endpoints repeatedly show 'posture unknown' and cannot evaluate anti-malware conditions. The administrator confirms the posture agent is running. Which component must be present and correctly configured in ISE for the posture module to obtain the definitions needed to assess anti-malware, disk encryption, and patch conditions?