This is the second part of two part essay on how to get security work done when you’re starting a new security program done at a company. In this part, we’re looking at the properties of the technical ecosystem and the team that each have the biggest impact on security program outcomes, the different categories of security work, and how they’re best staffed and organized. 

Once you’ve decided that it’s time to start a security program and you’ve figured out what work you’d like to start with — either from your own expertise or an outside review — it’s time to figure out how to get the work done.  Most companies, though, run into some complications when they try to put a security program into practice.  In this essay and its sequel, we’ll look at the key features an organization needs to successfully roll out and execute a security program.  In this piece, we’ll focus on executive decision-making and the project management process.