In my experience with building an information security program from the ground up, I often encountered the expectation that all I needed to do to build the program was simply buy a tool or pick a framework As information security professionals, we have all seen a situation like this - Company A is tasked to both build and implement an information security program, but they are not sure where to start. What typically results is the purchase of an EDR, SIEM, antivirus and any other latest buzzword tool. While this standard package may provide some measure of security, it by no means solves the overall requirement of an information security program.

All too often there is too much focus on selecting a framework and not enough on structuring the program itself for the enterprise-size business. It is important to understand that no matter what framework is chosen, it is only one part of the overall security program. To truly have an effective information security program, you should focus on seven key components that we will cover in this multipart blog series:

This first blog post of the series addresses what may be the most important part of successfully starting an information security program: getting executive buy-in.

Executive Sponsorship

To put it simply, when building a program that will impact every aspect of how a business functions, it is important to have someone that speaks to all levels of the business and helps remove any potential roadblocks to adoption. This person is the executive sponsor. When selecting your sponsor, choose someone with the authority, accountability and responsibility to help ensure the success of the program implementation.

Executive sponsors are responsible for key factors in project creation. They will effectively scrutinize and approve budget requests, which, given enough political capital, should not be an issue. They can pave the way for a smooth, multiteam project by providing the right expectations and any support needed from leadership.

Despite the usefulness of the executive sponsor, it is still important to let the project team run the project. Together, the executive sponsor and project team are the go-tos for both successes and challenges. In terms of successes, they can spread the word about the great features and significance of your project so that it is easier to get budget approved.

To help overcome blockers where no movement is happening, executive sponsors should be empowered to initiate positive change to help ensure the success of the project. They provide the team with enough runway so that business challenges, such as those involving budgeting and processes, are ideally solved well before they become major blockers. It is also important to work with the sponsor to review changes and plans to avoid any missteps. It is only through consistent communication that you can work through all the challenges ahead.

Now that we have identified the responsibilities and values of an executive sponsor, the next step is to identify how to obtain one. This can be difficult, but I have found when building an information security program that if you focus on the key points below, you can find the ideal sponsor for your project:

Using some or all of the above strategies will put you on the right course to securing a strong executive sponsor. In our next blog post, we will dive into asset management and how it impacts the success of an effective information security program implementation.