4. Start with your fears to protect what's essential

4.1 Focus on the company's internal control objectives

IT contributes to the company's businesses, and information security must meet the quality and safety requirements of these businesses. We need to establish a security indicator that is linked to the impact avoided (figure 4 ); then, security will be legible and managed as a performance factor. Indeed, if the company is unaware of any "business" impact induced by IT, it may believe that the result would be the same without security, and that it would be a good idea to invest less in things that, after all, are restrictive.