Information Security Program

To execute the security strategy and achieve the security objectives defined by governance.

A program is an ongoing, coordinated set of activities and projects; a project is temporary with a defined end.

The strategy defines desired outcomes; the program is the vehicle that implements and operates them.

Policies, standards, procedures, controls, awareness, and operational security services that reduce risk to acceptable levels.

To ensure security investments support, rather than hinder, the organization's goals and deliver value.

A sequenced plan of initiatives over time that moves the organization from its current state to the desired security state.