According to the CISM Review Manual, the first step to establishing an effective information security program is to create a business case that aligns the program objectives with the organization's goals and strategies. A business case provides the rationale and justification for the information security program and helps to secure the necessary resources and support from senior management and other stakeholders. A business case should include the following elements:
The scope and objectives of the information security program
The current state of information security in the organization and the gap analysis The benefits and value proposition of the information security program The risks and challenges of the information security program The estimated costs and resources of the information security program The expected outcomes and performance indicators of the information security program The implementation plan and timeline of the information security program Reference = CISM Review Manual, 16th Edition, Chapter 3, Section 2, pages 97-99.