One of the challenges is getting the Buy-in and Mindshare of the Senior Management about the need to invest on securing Information and to sensitise them on the concept that Information Security is NOT just an IT issue. Discovery Assessment is a test of the current information security posture of the organization conducted over two weeks. The test culminates with a presentation to the top management showing the current levels of risk across people, process and technology and highlights the expected loss because of the current state in monetary terms. This is followed with the implementation of the information security framework.