30 seconds on

Organizational support:

In addition to executive understanding, you should seek to ensure that others in the company understand that IT security professionals are integral to the organization as custodians of business assets -- their help will be needed.

Others must step up

Before undertaking a corporate-wide risk management program, make sure the leaders of business units realize they bear some responsibility for the information they own and use. They must help IT security pros protect data.

A lifecycle approach:

Security pros must work with heads to conduct a business impact analysis, which includes outlining business practices, prioritizing mission control data, application and network segments and defining regulatory requirements.