Emphasize how we must first know ourselves by identifying, examining, and understanding the information and systems currently in place.
Explain how in order to protect our assets, defined here as the systems that use, store, and transmit information, we have to understand everything about the information.
The policies, education and training programs, and technologies that protect information must be carefully maintained and administered to ensure they remain effective.