A security administrator has been tasked with implementing controls that meet management goals