We utilize a multiple-lines-of-defense approach in the testing of controls over data security threats, including business line risk management and corporate level risk management, with reporting of results and clearly defined escalation processes.