Now that you have gathered the information needed to properly rightsize and establish the vision for your information security program, it is time to begin establishing your plan. The information security program plan is a management document for the information security professional to establish key decisions and planning information as it relates to the execution of the information security program.