Organizational and IT changes, hackers, and much more present information security leaders with what sometimes seems like an insurmountable challenge: how to manage the risks their systems face in a cost-effective manner.

A comprehensive approach that assesses the organization's expectations and obligations for the confidentiality, integrity, and availability of critical systems and data; current and future program capabilities; and budget and human resource constraints is needed to ensure that expectations can be met - or re-aligned, where necessary.

This action underscores the need for a scalable and iterative approach to designing, executing, maintaining, and communicating an effective and defensible information security strategy.