The first step. Documentation of your systems, policies and controls.

Inventory your assets, physical or electronic, assign a value, define how you will protect it.

The next step in your information security cycle. Do it!

Implement effective information security controls to protect your business assets.

You've said it, you've done it, now check it.

Gain assurance that the controls you have in place will protect your business assets.