An information security manager has been told that the budget for IT security must be reduced. The manager wants to follow the guiding principles 'start where y...