This latter point--the need to link security to business requirements--is particularly important , and is illustrated in a statement of a security manager quoted in the Because every control has some cost associated with it , every control needs a business reason to be put in place .
They were on top of the requirements and any policies involved .