The security process brings operational requirements and “unknowns.” By advising on security approaches, we can identify controls and best practices that require attention.