What three things must the EBK do to ensure that it is the right model to ensure that it can protect a company's information from the sort of criminal activities?

What will be an ideal response?

First, there has to be recommendations in the EBK that would allow the company to identify and then formulate a substantive and effective set of measures to ensure that the company's information was adequately protected. Second, the EBK would have to provide a means to identify all relevant threats. Finally, the EBK must make it possible to generate explicit policies, procedures, and work instructions from the EBK that would ensure the most comprehensive governance solution possible.