When you are initiating a security program at an organization or have been brought in to revamp an existing security function, you are faced with the question of where to start. I have found myself ...