Information security is part of the organization's business culture and should be managed as a whole, in line with business objectives consistent with growth strategies. This strategy should encompass not only the organization itself but also its suppliers and service providers.