We leverage a variety of industry standard frameworks to inform our overall strategy (e.g., ISO and PCI DSS), overlay them with knowledge of our threats, risks, and insight from internal stakeholders, and adapt the frameworks and our approach to our operating environment.