Defensible Cybersecurity: Balancing Business and Operational Requirements