When resources are scarce, CISOs must begin to triage and determine what will deliver "the biggest bang for the buck" for system investment. That’s why it’s crucial for initial steps to establish the foundational security controls that act as a starting point for other security improvements in threat protection, identity management and more.