When you begin the work to establish your information security program plan, you must take the time to reflect on what your objectives are for the program. It is not enough to say that you are going to secure things. You must understand the culture and maturity level of your organization and allow this to guide you in the development of your plan.
For instance, if your organization is very immature and conducts business and operations in a very ad hoc manner, you will find it very difficult to institute a program that starts off requiring rigorous policies and procedures to be followed. Instead, you must meet your organization where they are at delivering security services that meet the current need while planning for more sophisticated services as the organization matures.
Regardless of the maturity of your organization,...
