https://www.sans.org/reading-room/whitepapers/critical/leading-effective-cybersecurity-critical-security-controls-36797