How Can We Most Effectively and Efficiently Protect It?—Choosing the Best Mitigations for Your Risk Profile

This chapter addresses the final Enterprise Security Risk Management (ESRM) question by focusing on how to select and implement security measures that deliver the most protection while using resources efficiently. It distinguishes between effectiveness, which is how well a control mitigates risk, and efficiency, which is how well it does so without straining budget, personnel, or operations. The chapter introduces Effects-Based Security (EBS), adapted from military doctrine and refined by security agencies, as the bridge from ESRM strategy to practical implementation. Rather than beginning with tools, EBS organizes security around seven core effects: deter, control access, detect, delay, assess, respond, and communicate and record. These effects are mapped to threats, assets, and controls, providing leaders with a structured way to layer defenses, identify high-value multi-effect measures, and avoid wasted spending. A section on validation emphasizes that controls must be chosen, tested, and measured against baselines to prove impact. Throughout, examples illustrate how misaligned investments can leave critical vulnerabilities unprotected, while effect-driven choices yield resilient, business-aligned programs. By grounding decisions in outcomes, security leaders can demonstrate that every control contributes directly to reducing risk, sustaining operations, and advancing organizational resilience.