Determine your risk profile and translate this into security measures, tuned to your organization and processes.