Information Security Handbook

Information security program maturity

As you work through the various frameworks, it is important to remember that they are not checklists. These frameworks need to be used to develop your own security program. A key aspect in developing a strong information security program is to understand that you should not be boiling the ocean. By this, I mean that you should not be trying to do so much that you end up doing nothing or worse, causing serious harm to the organization.

As you develop your plan to implement your information security program, you must consider where you are presently from an information security program maturity perspective. As you engage in planning, you need to think about how you can push your program along the maturity ...