| 1.3 |  | Security Framework and Policy |
| 1.3.1 |  | The security wheel |

| Most security incidents occur because system administrators do not implement available countermeasures, and hackers or disgruntled employees exploit the oversight. Therefore, the issue is not just one of confirming that a technical vulnerability exists and finding a countermeasure that works, it is also critical to verify that the countermeasure is in place and working properly.

This is where the Security Wheel, a continuous process, is an effective approach . The Security Wheel promotes retesting and reapplying updated security measures on a continuous basis.

To begin the Security Wheel process, first develop a security policy that enables the application of security measures. A security policy needs to accomplish the following tasks:

- Identify the security objectives of the organization.
- Document the resources to be protected.
- Identify the network infrastructure with current maps and inventories.
- Identify the critical resources that need to be protected, such as research and development, finance, and human resources.

After the security policy is developed, make it the hub upon which the four steps of the Security Wheel are based. The steps are secure, monitor, test, and improve.