For information security, planning is crucial. Due to the endless number of defenses a security team can establish, there’s theoretically no end to the tactics available. Furthermore, because security plans have a natural tendency to require input from many different business units to be successful, planning helps establish broader buy-in across a company to increase the plan’s effectiveness.
What makes planning even more challenging is the fact that security plans require complex items such as vulnerabilities or risk analysis to be properly understood and explained to business decision makers, who often don’t have the subject matter expertise but still need to decide. Therefore, it’s the security team’s job to translate these “wonky” topics for business decisions. This is almost always easier to accomplish within the context of a broader plan. ...read more!
