oversight, monitor security operations, and take action as needed, often under the direction of the chief information security officer (CISO). Increasingly, many companies are recognizing the need for a third line of cyber defence—independent review of security measures and performance by the internal audit function. Internal audit should