CISSP: Certified Information Systems Security Professional

Information security strategy is primarily risk-based. Risk management identifies and prioritizes the risks that security measures must address; budgets, existing controls, and applicable standards are important constraints or inputs but do not replace risk-driven prioritization.