Recently, KPMG and Cimation met with about thirty members of the Calgary business community to discuss industrial control system (ICS) security. Over breakfast and a brief presentation, we discussed the challenges organizations are facing as they try to develop, implement, and actively demonstrate the return on their cyber security strategies. Often these conversations focus on intentional cyber incidents; however, our conversation was dominated by a number of comments related to accidental infractions, which could be mitigated as well through increased governance and improved processes.