The value of information security is often only recognized after a breach or incident has impacted a business and its bottom line Without specific regulatory guidance  businesses are often unsure of the risk mitigation measures that are appropriate for their industry and threat environment