Abstract: A method and system for providing security to organizations having data and information, involving a vision specific to the organization by gathering information and determining current and future plans and needs, a scenario for protection from invasive activities including cyber-space and physical invasion, and intelligence to assist in determining protection. Also included are present and needed environmental concerns and threats, present and needed physical components, present and needed education and training for end users with access to the information, operations by examination, monitoring and detailing present and needed processes, and cyber presence including one or more computers, functions, locations, configurations, and trust relationships. Also considered are the importance of proprietary information, off-site back-ups, access-level restrictions to data, log books and preventions to minimize down-time of systems due to maintenance or attack.