Some duality, some overlap, some scientific methodologies.
Monitor and surveil both your IT and personal "outputs" i.e. what you or the network or system generates and redistributes in to the interconnectedness; be it social, personal or techincal.
*Then*, and only then, base your controls, processes, methodologies and frameworks or risk assessments upon empirical evidence.
No wonder it's so hard to listen to a system or network, when we don't even listen to ourselves.
Monitor the outputs. Control the inputs. Refine the processes.