Security Controls
Match the required controls to the organizational value of the data, the risk tolerance of the organization, and the investment required to meet the policy
Security policy can have wide ranging impact
- Business-wide review
- End result will be a compromise between security goals and business realities