The Information Security Blueprint

Introduction
Once an organization has developed its information security policies and standards, the
information security community can begin developing the blueprint for the information security program.
If one or more components of polices, standards or practices have not been completed, management must
determine whether or not to nonetheless proceed with the development of the blueprint.
After the information security team has inventoried the organization’s information assets and
assessed and prioritized the threats to those assets, it must conduct a series of risk assessments using
quantitative or qualitative analysis as well as feasibility studies and cost benefit analyses. These
assessments which include determining each assets current protection level are used to decide whether or
not to proceed with any given control. Armed with a general idea of the vulnerabilities in the information
technology systems of the organization, the security team develops a design blueprint for security, which
is used to implement the security program.
Security Blueprint
The security blueprint is the basis for the design, selection and implementation of all security
program elements including policy implementation, ongoing policy management, risk management
programs, education and training programs, technical controls and maintenance of the security program.
The security blueprint built on top of the organizations information security policies is scalable,
upgradable, comprehensive plan to meet the organizations current and future information security needs.
It is a detailed version of the security framework, which is an outline of the overall information security
strategy for the organization. The blueprint specifies the tasks and the order in which they are to be
accomplished.
Framework
To select a methodology in which to develop an information security blueprint, you can adapt or
adopt a published information security model or framework. This framework can outline steps to take to
design and implement information security in the organization. There are a number of published
information security frameworks, including ones for the government sources.