Top two drivers that influence IT security and IT compliance

1. Business drivers:
Business drivers represent constraints placed on by external elements. They can be viewed as business objectives with metrics. The drivers measure value, risk, and economic cost. Value drivers determine the worth of assets, of the system to the business, and of the business itself. Risk drivers involve compliance, corporate structure, corporate image, and the risk tolerance of the company. Economic drivers determine productivity impact, competitive advantage, and system cost.

2. IT drivers:
IT drivers represent operational constraints in the general IT environment. For example, the complexity of a system, including its environment, that is exposed to internal and external threats presents risks that the organization must address.

source: Introducing the IBM Security Framework and IBM Security Blueprint to Realize Business-Driven Security