organizational values. It maintains two key assumptions:
1. The more security holes left open for an (IT) system, the less secure it is.
2. Different IT servers might have different levels of importance in terms
of supporting the business’ core values.