The public seldom forgive twice.
Johann Kaspar Lavater, 1741–1801
The common method of building an information security program is to (1) review the laws and regulations that apply to the particular organization and determine which ones are pertinent, (2) develop a gap analysis or assessment to determine which controls are missing, (3) create an information security policy representing the required laws and regulations, and (4) developing and implementing controls to satisfy the policy that has been developed.
This process may appear somewhat simplified and make it sound as if it is a simple, quick exercise, when in fact this process can occur itera-tively over several years to move an organization ...
