Uncontrolled permissions and sensitive access without clear review.
Concentrated critical knowledge without defined procedures.
Informal processes and scattered evidence.
Threats and incidents without systematic treatment.
Contractual requirements that demand controls and evidence.
Incomplete documentation and little time to organize the management.


