A strategy sets 'improve security' as its only objective. What should the manager add?

1. A commitment to purchase every available control
2. A ban on all future changes
3. Measurable outcomes, accountable owners, and time horizons linked to business needs
4. More ambitious adjectives