Conclusion 28
Background 28
What did we do? 29
What did we find? 30
IT operations 31
Management of IT risks 32
Information security 33
Business continuity 34
Change control 35
Physical security 37
the majority of our findings require prompt action 38
Recommendations