Using these two frameworks; the underlying risk methodology; discussions with the CIO and CISO, other senior executives, and members of both the Technology and Info Security Committee and the Audit and Finance Committee of the Board of Directors; as well as white papers published by both commercial entities and industry trade groups, Internal Audit develops Information Technology and Cybersecurity Internal Audit Plans.