Watch this video on YouTube
What should be performed when a conflict between a security standard and a business objective arised?