This should be a driving force in the planning and governance activities of the organization as a whole. choices are: security awareness program, issue$-$specific security policy $($ISSP$),$standard$,$ strategic plan, policy, ISO $27002,$managerial controls, objectives, operational plan, information security, NIST SP $800-12,$Enterprise Information Security Policy $($EISP$),$guidelines$,$ SP $800-18$Rev$-1,$defense in depth, tactical plan, configuration rules.