The Group CISO role, the security committees and the data protection officers (DPOs) at group and country level monitor risks and govern compliance and report to management regularly, and the Board’s audit committee at least quarterly.