70% of CISOs say that information risk is treated the same as corporate risk in their organisation.