What it means
Security decisions allocate limited resources and often improve one objective while affecting another. Stronger authentication may add user friction; detailed monitoring may increase privacy impact and data volume; tighter network controls may complicate recovery or operations. The task is to choose a justified balance, not to eliminate every risk.
How it works
Teams define objectives and constraints, compare options, analyze affected stakeholders, estimate residual risk, document assumptions, and identify compensating controls. Decisions should be revisited when technology, threats, costs, or business priorities change.
Blocking all external file sharing may reduce data-loss risk but prevent legitimate collaboration. A better design may allow approved platforms, classification-based controls, expiring links, monitoring, and an exception process.
Practical focus
- Make the protected mission or business outcome explicit
- Compare multiple options and their residual risks
- Include usability, privacy, safety, and operational resilience
- Document who accepted the trade-off and when it must be reviewed
Common mistakes
- Describing any inconvenience as necessary security
- Optimizing one metric while shifting risk elsewhere
- Allowing undocumented exceptions to become permanent architecture
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: