The least effective controls are the ones you don't have

If you have no malware prevention, you're likely to have malware. If you have no data identification, you're unlikely to know where all your data is.

Understanding what's in your portfolio is a first step to a new view of your world.

Select what you need, not what's for sale today

Your controls must focus on business goals, not who gave you a lightsaber at RSA. (Don't get us wrong, we appreciate the more elegant weapons from a more civilized age as much as the next Jedi. But a Jedi might not be your next key control.)

Protect with people, process and technology

It's cliche for a reason. You need each, scaled to your needs.