Information Security Program Development and Management

This chapter talks about the process used to establish a new information security program and maintain an existing program. It explores how security awareness and training efforts provide individuals at all levels of the organization with the knowledge they need to support security objectives. The chapter also explains how to manage a cybersecurity budget and how to effectively integrate an information security program with other critical business functions. Strong training programs take advantage of a diversity of training techniques, including the use of computer‐based training. Phishing attacks often target users at all levels of the organization, and every security awareness program should include specific anti‐phishing campaigns designed to help users recognize suspicious requests and respond appropriately. Vendors play an important role in the information technology operations of every organization. Change management processes ensure that organizations follow a standardized process for requesting, reviewing, approving, and implementing changes to information systems.