right okay so typically that potential advisor your it manager or whoever it is in that business makes a decision on how secure they need to be would they go and seek a consultant consult Consultation or a consultant? You'll

hear stuff like risk appetite.

Okay.

So the business has to understand their risk appetite.

If their risk appetite is low, then a lot more things are open.

If it's higher, a lot more things are switched off or blocked, for example.

So it's not a case of the security person going, you know, we're going to accept this risk.

And lastly, a resilience plan, is that right? On if you are breached, what do you do when you're breached?