When defining a cyber-security program based upon industry standards, the first step that an organization's professional should take is to define the organization's objectives regarding security and risk mitigation. This includes identifying the assets that need to be protected, the level of risk that the organization is willing to accept, and the specific threats that the organization is facing. Defining these objectives will provide the necessary foundation to guide the design and implementation of the security program, ensuring that the program is aligned with the organization's business needs, risk appetite and compliance requirements.