For example, on top of establishing a robust ICT risk management framework, entities must be able to explain "how [the framework] supports [their] business strategy and objectives." In other words ...