Use the continuous monitoring data to make information security investment decisions to address persistent issues.