“FIGURE 5.2 9 Box of Controls Source: Harkins, M.W., Managing Risk and Information Security: Protect to Enable. Used with permission.”