For some businesses, the risk of a cyber$-$attack is one that seems far removed. Perhaps a common

misapprehension is that organizations who operate in sensitive sectors$,$ such as defence or healthcare,

are the main target. A survey from Nationwide found that only $13\%$ of business owners said they have

experienced a cyber$-$attack. However, that number jumped to $58\%$ when owners were shown a list of

attacks, revealing a clear lack of understanding about what constitutes an actual attack.

According to a report by McAfee, the global Cybercrime pandemic cost the world $$600$ billion in $2017,$

about $0\mathrm{.}8\%$ of global GDP$!$ While studies indeed show that sectors such as pharmaceutical and finance

are often targeted, businesses of any size and in any industry are vulnerable $-$ a detailed cyber security

strategy is essential.

Whatever sector you work in$,$ it$$s possible that it$$ll be you as a manager or IT lead who is more concerned

about cyber$-$attacks than senior management. Some leaders are unwilling to end up investing in

cybersecurity for a whole host of reasons, including calculated decisions to simply take the risk or

ignorance about the nature of that risk. In that case, it$$s again worth working with an expert to help develop

your case that prevention really is the best cure when it comes to company security.

Source: https:$//$www$.$darwinrecruitment.com$/$blog$/2018/10/$implementing$-$cyber$-$security$-$business

Question $1(20$ Marks$)$

As stated in the article, $$While studies indeed show that sectors such as pharmaceutical and finance are

often targeted, businesses of any size and in any industry are vulnerable $-$ a detailed cyber security

strategy is essential.$$ A cyber security strategy includes an organizational framework for security and

control. Elaborate on the components of an organizational framework for security and control