Companies and organisations must take an active Risk Management including regular risk assessments. The risk assessments should identify the potential threats and risks to the information security of the company's systems and services.