Evaluates an organization's current security policies, processes, and controls against compliance standards or best practice frameworks to establish a security baseline.

Develops a prioritized plan to address security risks by balancing policy, technology, and people controls to achieve a defined target security state.