How do you turn data into knowledge?

	1.	Assess risks across the organization; identify information security and privacy risks; implement countermeasures; establish security and privacy posture; review supply chain for IT security risk elements
	2.	Establish basic security posture; review risks; implement countermeasures; perform ongoing monitoring and assessment, testing, and training
	3.	Set priorities; assess risks; select controls and countermeasures; implement controls; validate correct operation; monitor
	4.	Develop business impact analysis; establish risk tolerance levels; implement damage control choices; monitor