Below are the top five considerations when developing security policies for your organization:

1. Have a Security Risk Project Portfolio:  Take the time to identify, define, prioritize, and then track the status of the initiatives for your security program. Document, document, document!

 

2. Employ Project Management Fundamentals: Your project portfolio should reflect the time, resources, and budget required for each initiative.

 

3. Be Realistic:  Your project listing should reflect what you actually plan to do. If you create a list that you have no chance of accomplishing, then you should take a step back and evaluate why that is the case.

 

4. Have a Strong Reporting Capability: This is the best way to show the rest of the organization how much your security program is doing for the organization.

 

5. Measure Your Progress: Evaluate what is working and what is not, and then make changes as often as necessary.