Focus on those that are critical and sensitive in terms of compliance, customer privacy, and competitive position. In many financial organizations, this process requires collaboration between IT and the business units' owners, and legal counsel. The security strategy should task forces with representatives from each department to analyze business processes and the information and infrastructure they depend on. The primary objective is to document the way it's done and understand what the true process is.