Protecting CeriFi: Why IT Security Policies and Compliance Matter