Two-thirds (66.3% of all CISOs) surveyed said that their organisation does not measure the operational cost of managing compliance.