Monitoring various aspects of the organization 's security-related activities by testing controls , accounting for the number and types of security incidents , and evaluating compliance with policies .
There is generally poor compliance with security policies .