The key concepts of ensuring that security policies related to information are effective and enforced. Often, contracted third parties are involved in making sure of that. Those same security policies should often be tested for their effectiveness and if they're being enforced properly.