premise: This latter point--the need to link security to business requirements--is particularly important, and is illustrated in a statement of a security manager quoted in the  Because every control has some cost associated with it, every control needs a business reason to be put in place.
hypothesis: They were on top of the requirements and any policies involved.