Risk assessment
There is no such thing as perfect security. You have to know precisely what the information gathered in each division is really worth, and how a deliberate or natural damage or breach of it would affect the company.
From the matrix of these risk factors we create the security plan: the basis of a defence strategy that fits the value of the information.