3-A. Identify and Evaluate Options: Create or Update Overall Security Plan

Identify desired solutions

• Nature of security gap
• Relevant best practices
• Local capacity and resources
• Available budget

Prioritize Actions

• Potential organizational impact
• Immediacy of threat
• Cost of prevention vs. repairing damage
• Time to implement
• Likelihood of success

3-B. Create and Implement Task-focused Action Lists

• Assign responsibilities & Schedule actions
• Reapply stress tests
• Evaluate success

3-C. Review & Revise Standard Operating Procedures & Policies

• Analyze lessons learned
• Discuss needs with decision-makers
• Revise operating procedures