Whether you’ve over-invested in security tools, under-invested, don’t know the extent of your security capabilities or you’re facing new regulations that require you to demonstrate and continually maintain compliance — there is a path forward. To understand and optimize what you have in place, as well as gaps you may have, develop a security rationalization process to calculate the return on your security investments. This paper outlines to five steps needed to get started.