A good IT security strategy starts with understanding where the organization is now and where it needs to be. The organization should not just follow the crowd.