This latter point--the need to link security to business requirements--is particularly important, and is illustrated in a statement of a security manager quoted in the  Because every control has some cost associated with it, every control needs a business reason to be put in place.