Step 3: Define a Security Strategy