To expand upon one aspect of that, this paper describes a few processes companies are not honing in on well as of yet. Securing your networks through software can only partially protect your data. It is a well-known fact that keeping your servers and networks physically secure also plays a large part in keeping your data secure. I say it myself quite often. Some hire security guards to sit at a reception desk to stop unauthorized people from entering.
Many companies keep their machines behind locked doors.
No person can get to the data because they don't have a card to the door to get into the server room, and the guards are at the front door to make sure unauthorized people don't come in. In addition, you have had an independent firm come in and audit your computer security internally and externally. Enter social engineering. Social engineering preys on the trust and idiosyncrasies that humans, and society as a whole, have developed and implicitly adhere to whether as part of a social construct or out of familiarity. Social engineering is one of the easiest ways to get information from a company since it requires little to no technical expertise.