The next thing is really to ensure that your management fully understand your strategy, then the benefits behind this, and there are a number of things that we can do and one way of showing that management commitment is putting together a clear information security policy and in that policy, that’s where you are going to state what your company’s vision and mission is going to achieve. So, once you have took your time to identify your risks, implement your controls, and also check whether those controls are working for you and you have done with your internal and external audit.

To get real benefit from the security control, security monitoring and the security measurement at your company is not just about certification, it’s not just about doing what you need to do to get through the audit. There is a lot of work from here to do in terms of embedding these processes, raising awareness, getting people in your organization familiar with what their role is from a security point of view and having a long-term strategy to achieve your objectiveness. This is the most challenging part in security and risk business. This is the place where you have to keep opening your eyes.