•  How literate and aware are our employees about the IT governance and cyber security? •  Is there an organisation culture for detecting and reporting of violations? •  Is there a zero tolerance policy about breeches of policies? •  Do business partners share and observe your governance and security policy?
All these assume significance in view of the fact that the internal threats from employees and third party service providers are as critical as external threats. 3  Source: Symantec Intelligence Quarterly: July - September, 2011. 4  http://newindianexpress.com/business/article551583.ece. BIS central bankers’ speeches  5  Governance in IT Is IT governance all about IT?