Week 1: Discussion
Define the three levels of Information Security management planning. List the types of
Information Security plans and planning functions. What are the main goals and objectives
of each of these plans?
Answer:
Information security management planning typically involves three levels of planning to
effectively safeguard an organization's information assets:
1. Strategic Planning:
This is the highest level of information security planning and is concerned with aligning security
with the organization's strategic goals and objectives. Establishing the organization's security
objectives and priorities. Developing an information security policy that outlines high-level
security goals. Aligning security initiatives with business strategies and risk tolerance. Ensuring
that senior management and stakeholders are aware of security priorities. Allocating resources
and budgets for security initiatives. The outcome of strategic planning is a clear strategic
direction for information security, which ensures that security measures are in line with the
organization's mission and long-term objectives.
2. Tactical Planning:
Tactical planning translates the high-level strategic goals into actionable plans and initiatives. It
involves the development of specific security programs, projects, and policies. Developing and
implementing security policies, standards, and procedures. Identifying and prioritizing security
projects and initiatives. Defining security roles and responsibilities within the organization.
Implementing security technologies and controls. Conducting risk assessments to identify and
manage security risks. Tactical planning results in concrete, measurable security programs and
projects that are designed to achieve the strategic security objectives. It ensures that the
organization has a clear roadmap for addressing security risks and implementing security
measures.
3. Operational Planning:
Operational planning deals with the day-to-day activities and tasks required to manage and
maintain security within the organization. Monitoring security controls and systems for
