There is much known about logical ways of implementing security measures in an organization. Anecdotal evidence shows that few organizations implement a full suite of measures. This study used a single case to identify problems with a logical implementation. A framework was developed using the literature and these identified problems. The framework was then tested through interviews of experienced professionals.