Security governance needs to be more than an annual compliance exercise. New companies are emerging to address risk-management gaps in current audit tools.
Checkbox Assessments Aren't Fit to Measure to Risk
Summary + source link. No paywalls, no tracking.