4-So, you kept your security and risk management documentation, now what?