Develop information security plans aligned with business goals and objectives.
Identify current and potential legal and regulatory requirements affecting information security.
Identify drivers affecting the company (e.g., technology, business environment, risk tolerance, geographic location) and their impact on information security.
Obtain senior management commitment to information security.
Define roles and responsibilities for information security throughout the company.
Establish internal and external reporting and communication channels that support information security.
Establish a process for information asset classification and ownership.
Implement a systemic and structured information risk assessment process.
Ensure that business impact assessments are conducted periodically.
Ensure that threat and vulnerability evaluations are performed on an ongoing basis.<...