Security strategy using multiple layers of controls. If one layer fails, others provide backup protection. Combines physical, technical, and administrative controls.