Security is not a “project” of some kind but a long running process that will need change and regular reinvention to adapt to the ever changing threat landscape. Security is about people (organization), process, and technology, according to the SABSA (Sherwood Applied Business Security Architecture), and many other standards and best practices, best practices. An important point is to make an impact and improve the overall security situation as soon as possible. This will then build your credibility bank, which is quite important at a later stage when you need to leverage those relationships and trust.”]
Source: https://www.csoonline.com/article/2133110/book-excerpt—c-i-so–and-now-what–.html