Ideal?

Good People, Process and Technology

A corporate culture the values security ... you know: bakes it in (not bolts it on)

Operational Risk Management mindset & decision making

Training to ensure everyone knows their role

Identification of cyber and data "assets" (crown jewels)

A design of technology & processes to assure "what is" matches "what you think it is" -- including external audit, security-specific operations, etc.