Small or one person IT shops don't have a large amount of resources to put towards security. We're responsible for far more than just security and there are many competing demands for our time and attention. How do we make decisions on security projects in a sea of acronyms and products? This is one man's framework to eat the elephant.