Information security activities need to take into account the Compa­ ny’s goals, the legal framework, economic criteria, information assets, cultural issues, technical possibilities and threat scenarios.