Information Security Program Overview

An information security program covers all the activities and processes that collectively provide security services to an organization. Some common activities of security programs include the design, development, and implementation of security-related controls throughout the organization. Controls can be in the form of simple policies and processes or advanced technological structures. Depending upon the size and nature of the organization, a security program can be managed by either a single individual or a specific team headed by the chief information security officer (CISO).

Figure 5.1: The role of the chief information security officer

A security manager is expected to have thorough knowledge of information technology as it helps to understand how changes in an organization's technical environment can affect its security posture. An information security manager is required to evaluate the risk of technology and...