Build a manageable security stack around the risks your business actually faces, with clear owners, practical checks, and a recovery plan.