Welcome to the GCC 6300: Security Organization
Appropriate security must start with business needs, since the business defines what essential resources they can invest in effort. This begins with policies but continues through standards and processes. None of these can be developed in isolation, however, nor can they remain stagnant since attacker techniques are continuing to evolve to counter controls in place. This is why threat intelligence and effective communication with staff and external stakeholders are both essential.
