Contents of a Security Plan
A security plan identifies and organizes the security activities for a computing system. The plan is both a description of the current situation and a map for improvement. Every security plan must address seven issues:
• policy, indicating the goals of a computer security effort and the willingness of the people involved to work to achieve those goals
• current state, describing the status of security at the time of the plan
• requirements, recommending ways to meet the security goals
• recommended controls, mapping controls to the vulnerabilities identified in the policy and requirements
• accountability, documenting who is responsible for each security activity
• timetable, identifying when different security functions are to be done
• maintenance, specifying a structure for periodically updating the security plan
There are many approaches to creating and updating a security plan. Some organizations have a formal, defined security-planning process, much as they might have a defined and accepted development or software maintenance process. Others look to security professionals for guidance on how to perform security planning. But every security plan contains the same basic material, no matter the format. The following sections expand on the seven parts of a security plan.
