An organization is transitioning to a more agile data protection environment using new technologies. What should be their primary focus in security management?