Internal tracking of established measures (e.g., from risk management, audit reports, security incident reports, minutes, etc.). Ensuring compliance with legal and regulatory requirements (e.g., Critical Infrastructure Regulation, IT Security Act,...