What is a feasible and sufficient security strategy for our organisation?