Decision
IT controls required?
Establish control activities ICS ERM