This chapter explores best practices and topics to consider in security spending by framing them around four stages of IT management: assessing, designing, deploying, and monitoring/managing. We have to also consider the need for attention to security education.