From the AVP - 7 Key Elements for Making an InfoSec Program Operationally Effective

1. Governance - Oversight
2. Policy - The simple, brief, high level set of enterprise goals for InfoSec
3. Architecture - A business architecture mapping InfoSec requirements against basic capabilities
4. Awareness and Training - Making the enterprise aware of the first three elements
5. Technology - The hardware and software infrastructure that embodies the goals of the policy, conforms to the architectural standards, and supports and amplifies the governance and training principles set forth
6. Logging, auditing and reporting - The specific outputs and related management actions that allow the organization to check, at every relevant level, the working of the preceding elements
7. Revitalization - The ongoing process of verifying the relevance and currency of the program