PROTECT, DETECT, RESPOND: THE ESSENTIALS OF A SECURITY MANAGEMENT SYSTEM