A licensee must ensure that comprehensive strategies and measures are in place to manage cyber security risk including prevention, detection and recovery measures.