A new CISO inherits a control program measured mainly by installed tools. Leadership asks how security supports expansion into regulated markets. What should the CISO establish first?

1. A standard firewall model for every country
2. A larger tool inventory
3. A security strategy linked to business objectives and risk appetite
4. An immediate increase in phishing simulations