Without mandating a single tool: portfolio policy, scenario routing, budget, security, training, and metrics.