How do you balance security controls against usability and business needs?

Show that you understand security which people work around provides no protection at all.

• Start from the risk, not the control. Applying maximum security everywhere is both expensive and counterproductive. Protect the crown jewels heavily and accept lighter controls elsewhere.
• Prefer controls users do not feel. Single sign-on with conditional access is better security and less friction than forcing separate complex passwords everywhere. Automated patching beats asking people to reboot. The best controls are invisible.
• Watch for workarounds as a signal. Passwords on sticky notes, personal cloud storage for files, and shadow IT are all evidence that a control is too painful. That is a design failure, not a user failure.
• Involve the business early. A control designed with the team that will live under it survives; one imposed on them gets circumvented.

Note: The password guidance shift is a good concrete example — NIST now advises against forced periodic rotation and complex composition rules, because they produced predictable passwords and reuse. Longer passphrases, breach-list checking, and MFA give better security with less friction. Citing that shows you follow evidence rather than tradition.