a formal security strategy is implemented in part by developing and deploying comprehensive that reflect the objectives of the organization and address each element of the strategy.