Management commitment, assign project responsibilities

Once the decision to implement has been taken, or even before it, there needs to be senior management commitment to the process. The commitment of top management is essential for the implementation to succeed - without this it stands a good chance of failing. Once this is in place, appropriate resources must be assigned to the project for its duration.

As part of this process, a security organisation must be defined. As a minimum, there must be someone in the organisation who is responsible and accountable for implementing, monitoring and managing information security in the organisation. Depending on the size of the organisation, this person may be supported by a number of other staff.