“How often does the whole enterprise review its business priorities, and how often (if at all) are those priorities communicated to the security organization?”