Knowing how and what to protect and what controls to put in place is difficult. It takes security management, including planning, policy development and the design of procedures.