Aligning our activities with the three lines of defence model, as an established good practice model for designing an information securi­ ty organisation, is a major part of our information security strategy.