You are responsible for selecting security controls for a multinational organization's information system. The organization has a diverse IT infrastructure, including on-premises, cloud, and remote work environments. The system processes sensitive financial data and is subject to multiple regulatory requirements. Which of the following approaches would be MOST EFFECTIVE in selecting the appropriate security controls for this complex environment?