text: Monitoring various aspects of the organization 's security-related activities by testing controls , accounting for the number and types of security incidents , and evaluating compliance with policies .
  
  ###
  
  There is generally poor compliance with security policies .