Establishing trust: transferring certain controls to non-IT and non-security staff Remaining in control: implementing continuous auditing as permanent control element Control on trust: improve control by evaluating security measures and surveys with your teams