Source: https://www.sans.org/media/critical-security-controls/case-studies/BitSight-WhatWorks-Case-Study.pdf