Key elements of the program include security governance, security awareness, employee training, access management, perimeter and end-point security, vulnerability management, penetration testing, security monitoring and incident response.