“Our information-security and data-protection teams, as well as other second lines of defense, such as IT risk, have all been part of the journey from day one. The security requirements have been integrated into the work process by design, not as an afterthought.”