Increasingly we see that companies want to be in real control of their Information Security and any associated legal (think EU GDPR, NIS2, CRA & DORA) or customer requirements. What does it actually take to get in control? What do you need to do, like, really, in detail? Break it down into bite-size pieces you can deliver? Sure.