Dr. Richard Browne:

That is one analysis. It is important to point out, though, that entities have to own their own security risk because they make their own investment decisions and they own their own systems. We can exercise, as we do in the HSE, an oversight role in respect of compliance. We can give bodies support and assistance, which we do. Ultimately, however, because the HSE owns the system, it must own the risk. That is-----