I don’t think that there was a second layer of behavioral controls at all. It’s also about forcing best practices, maturing areas of leadership and managing risk, which are often antithetical to what security teams actually want to be doing.

Source: Cyber Talk