Security Strategy: From Requirements to Reality