Remind students that the primary objective of the CISO and the Information Security (IS) management team is to create the security strategic plan. Explain that this plan is an evolving statement of how the CISO will implement the objectives expressed in the Enterprise Information Security Plan.

Stress that clearly directed strategies flow from top to bottom, and a systematic approach is required so that all members of an organization are aware.

Define that everyone in the organization will likely use the information provided and not just strictly information security or technology professionals.