A welcome set of recommendations, management should be held accountable for cyber security risk management, not just IT.