Determine your users' needs, management's tolerance for spyware and malware, and your industry's requirements.