Thoughts on cyber/IT/information security management with a focus on the Canadian public-sector context. All content is personal opinion.