I see you stopped reading my post pretty quick, as I covered all of those other factors. You have to ask yourself what are you protecting against? Then solve for that.
Very often you will find when you want to protect everything against every situation the organization will not shell out the $$ to cover even a fraction of what you may want to protect (whether it is $$ for hardware or $$ for staffing to do it, test it etc).
Biting the hand that feeds IT
