Stepping Through the InfoSec Program

The information security professional has evolved from computer operator to chief information security officer; from controlling punched cards to negotiating strategic plans, defining policies, documenting processes, managing technology, measuring performance, controlling costs, supporting business recovery and demonstrating regulatory compliance. This publication includes a case study and steps to: Compose an information security program Cement a relationship between an information security program and IT governance Design roles and responsibilities to ensure accountability Identify and allocate resources to achieve information security program objectives Determine if an information security program is achieving objectives