Conducting a security assessment for media companies