17. When discussing security policies and implementation tasks, one should follow a checklist with three items: 1) things to do; 2) things to pay attention to; and 3) things to report. Is this true or false? Explain. 18. It is advised to always have discretion with leaders. Explain in general terms what information security policies can and cannot achieve. It is equally important to be conservative in your estimates regarding the impact on the business; otherwise you risk losing credibility. Is this true or false? Explain.