Management of Information Security 4th Edition by Michael Whitman ,Herbert Mattord

Exercise 2

Iris sighed as she completed her initial review of her staff's checklist results. She pulled out a notepad and began outlining the projects she foresaw, based on the shortcomings identified via the checklist. She had decided to use the NIST approach for her security management planning and was fortunate to have found a useful model for an InfoSec review of her program.
Will the use of the NIST SP that Iris has identified to create a "To Do" list create a customized and repeatable InfoSec program for the company What else is needed to make a security management model into a working security program