https://www.pivotpointsecurity.com/operationalizing-your-information-security-strategy/