Examines the methodology by which an organization aligns its business strategy with its security operations. Both the current and desired future states of the business’ security efforts are described so that resources can be directed to the security efforts most needed to support the business.