Watch this video on YouTube
Why should security controls be justified within a risk management process?