Skill in discerning the protection needs (i.e., security controls) of information systems and networks.