Assessing how much a company is legally obligated to invest in cybersecurity remains a challenge. Since there is no such thing as perfect security (i.e., there is always more that you can do), resolving these questions can signi?cantly affect cost. a. When are a company’s security measures suf?cient to comply with its obligations? For example, does installing a ?rewall and using virus detection software satisfy a company’s legal obligations? b. Is it necessary for an organization to encrypt all of its electronic records?