Effective security programs require structure to understand what should be protected and the value of the asset to the organization to determine how protection should be implemented. No matter the methodology companies choose, the framework needs to define measurable outcomes that allow IT teams to defend against attacks and recover quickly if an attack is successful.