Proportionate measures are security controls matched to the level of risk, the value of the asset, and the likely impact of failure. Instead of applying the same protections everywhere, an organization scales safeguards so critical services, sensitive data, and high-exposure suppliers receive stronger attention than low-impact systems. This is a core risk-management principle because cybersecurity resources are limited and controls should address real exposure, not generic templates.
In practice, proportionate measures appear in decisions such as stronger authentication for privileged access, tighter monitoring on critical services, deeper vendor checks for key suppliers, or segmented networks for systems that would cause major disruption if compromised. Attackers often exploit places where defenses are too weak for the business importance of the target. Defenders use proportionality to justify why one system needs heavy hardening while another can remain simpler, making security both effective and defensible.