Broad Outline of Security Plan (RFC 2196)

• Assets: Identify what you are trying to protect.
• Threats: Determine what you are trying to protect it from.
• Risk Analysis: Determine how likely the threats are.
• Security Mechanisms and Tools: Implement measures which will protect your assets in a cost-effective manner.
• Security Assurance: Montior events, Handle Incidents. Review the process continuously and make improvements each time a weakness is found.

Cost of protecting yourself against a threat should be less than the cost of recovering if the threat were to strike you.