Agencies need to shift their mindset from seeing cyber security as a ‘checked box’ and move towards a comprehensive alignment with best-practice cyber strategy that is reviewed on a regular basis.