One thing I've learned while building out COSO is how to be 'agile'. And I don't mean that stupid fucking corporate bullshit version of 'agile' they make you go on courses about either.
I mean actually 'agile' inside an internet ecosystem.
That's the only 'agile' that really matters because threats evolve and change way too quickly for a powerpoint presentation huffed down your throat for an irrelevant 'cert' in a conference hall by some fucking pencil neck to keep up with.