Security governance - launching the offensive

1. Tender, employ, buy, build, educate in as small a chunk at a time as you can manage

2. Test security activities have addressed KPIs and KRXs they were planned to improve as part of regular compliance testing cycle (just delay testing cycle until project completed)