In reply to CyberCurious.

People, policies and product IIRC (or words to the same effect). This was research that came out of Security Advisory EMEAR from our red team where we took the issues we were finding and mapped the effective control points.