Why is it important for a company to have policies about communication exchanges to control threats to IT systems?

Beginning in Chapter 20 (attached), Calder and Watkins (2020) identify several communication exchanges that are covered under the Governance of IT provisions.
> Why is it important for a company to have policies about communication exchanges to control threats to IT systems?
> If you were consulting with a company about IT governance approaches, what are three methods that you would suggest a company use to reduce risk?
> With the rise of global phishing attacks ( https://www.statista.com/statistics/266155/number-of-phishing-domain-names-worldwide/ ), what do you think companies should be doing in the next year to protect their company, stockholders, and customers?
Need 3 pages with peer-reviewed citations. No need for introduction and conclusion.