4. From tactical to strategic… Evidence? Yes Identify opportunities to reduce costs of information security and avoid duplication Evidence? Yes Communication tool across functions and levels – a security conscious culture Evidence? Yes Strategic, risk based approach to information security aligned with business objectives Evidence? Yes Mitigate risks to acceptable level Evidence? Yes Meeting legal and audit requirements Evidence? Yes Protect our brand Documents and Spreadsheets ClockworkISMS Benefits