Information technology is no more an enabler, it has become a part and parcel of business processes. Consequently, the asset composition of organization has, with the concomitant vulnerabilities and risk, undergone significant changes. In the new scenario, stakeholders are apprehensive about the security of information systems. Regulators all over the world have therefore realized the need for …