Suitable for Enterprises where IT processes are always evolving and new technology or upgrading current technology is always on the roadmap. They assessed risk and built competitive security programs with personalized solutions and industry-specific standards. Identifying the current state of affairs and designing a target state based on expert guidance. Probably not suitable for small businesses where IT security is either outsourced or not a strategic roadmap.