People are often the weakest link, so consider the risks posed by suppliers, employees and other users, in addition to technical risks. ??? Ensure that you understand your legal and regulatory obligations (and recourse) with respect to cyber-attacks.