This chapter takes the normative framework under the rights to privacy, data protection, communications freedom and the right to science. It then applies this framework to the governance measures with regard to the information security cycle. It discusses the taking of measures, where it concludes that current governance measures focus too much on a sectoral approach, whereas it also follows from the rights to privacy and communications freedom that a more horizontal approach is warranted, For the offensive side of information security, it concludes that researchers under this normative framework are protected in doing research into information security and publishing the findings, but that governments and researchers have a duty to mitigate the risks following from this research.