A good IT security strategy starts with understanding where the organization is now and where it needs to be. The organization should not just follow the crowd.
https://www.securitymagazine.com/blogs/14-security-blog/post/100073-how-to-hold-it-security-strategy-conversations
