Watch this video on YouTube
What should an information security manager do to establish security baselines?