What CIOs should decide before a transformation programme starts: who watches the alerts, who owns identity, and how security keeps pace with change.