Strategize and Plan: Define target state. Identify and prioritize security requirements, based on business objectives, the threat and risk environment, and compliance requirements. Establish accountability for security. Develop a security program aligned with business needs.