Iris sighed as she completed her initial review of her staff’s checklist results. She pulled out a notepad and began outlining the projects she foresaw, based on the shortcomings identified via the checklist. She had decided to use the NIST approach for her security management planning and was fortunate to have found a useful model for an InfoSec review of her program.

Questions:
1. Based on your understanding of the chapter, from which NIST Special Publication did Iris draw her initial checklist?
2. Will the use of the NIST SP that Iris has identified to create a “To Do” list create a customized and repeatable InfoSec program for the company? What else is needed to make a security management model into a working security program?