How do you know where you are going if you do not know where you currently are? Security leaders often struggle to effectively plan because at its simplest levels, it's hard. There are so many competing priorities, such as, business demands, regulatory requirements, competing technologies, etc. These competing priorities influence the decision and the direction of your security program. What we often see, is that leaders are unable to begin or sustain progress because they lack planning or the understanding of where to start.
So how do we do it?