RSA recently published their inaugural Cybersecurity Poverty Index. Almost 66 percent of organizations rated themselves as inadequate in every category. The report is based on self-assessments by organizations who compared their current security implementations against the NIST Cybersecurity Framework. It would appear that the lack of focus on information security is a top-down problem. Good information security only has an indirect relationship to the amount of money spent. Good fundamentals, and a daily focus, start with good fundamentals and a good art work.”]
Source: https://www.csoonline.com/article/2935941/what-defines-a-mature-it-security-operation.html