The Information Security Master Plan (PDSI) defines where the organization's security stands today, where it needs to go, and the order in which initiatives will be executed, with deadlines, owners, and budgets. It is a multiyear plan, usually spanning three to five years, reviewed annually.
The starting point distinguishes a useful information security master plan from a document left on a shelf. When the assessment comes from a questionnaire completed by the team itself, the plan reflects what the company believes about itself. When it comes from testing, it reflects the actual environment.
Master plan, policy, and security plan: what is the difference?
The information security policy establishes the rules: what is allowed, prohibited, and required. The security plan brings together the operating procedures for implementing those rules. The Information Security Master Plan is the roadmap for improvement: what to build, in what order, and at what cost.
The distinction prevents a misguided purchase. A company that commissions an Information Security Master Plan and receives a set of policies gets rules of conduct but no guidance on where to invest.
What an information security master plan includes
In the Vultus methodology, the plan brings together eight components:
- Red Team Assessment: a penetration test in the real environment to identify the risk that actually exists.
- Maturity assessment: assessment against NIST CSF 2.0, ISO 27001, and CIS Controls, with NIST's 106 subcategories evaluated across five levels.
- Executive risk assessment: scenarios combining threat actors, events, and incidents, calibrated by likelihood and impact.
- Process mapping: comparison against a value chain of 40 reference security processes.
- Technology assessment: protection layers from the perimeter to the cloud, with a current and future perspective.
- Security structure: team sizing and the security leader's reporting level.
- Management indicators and routines: Strategic, tactical, and operational KPIs, with the committees overseeing each.
- Roadmap: initiatives in annual waves, with a budget for each wave.
The order for building the plan
The sequence matters. Assessing before testing produces a plan that fixes what the company already knew and leaves out what no one had seen. That is why testing comes first, followed by measuring maturity against a recognized framework.
Next come defining risk appetite, mapping the gap between what exists and what is needed, prioritizing by impact and urgency, and organizing initiatives into funded waves. An Information Security Master Plan that includes Red Team testing takes about eight weeks.
Why many plans stall at governance
The 2026 Cyber Risk Landscape, a Vultus study of 132 organizations across 11 sectors, measured maturity by pillar on a scale of 0 to 5: technology at 1.87, people at 1.67, processes at 1.62, and governance at 1.48. Across the NIST functions, efforts are concentrated on protect (1.94) and detect (1.82).
The same study found a structured business continuity process in only 23% of organizations. The layer that sets priorities and sustains the pace of execution is precisely what the master plan should build.
The external landscape also calls for long-term planning. The Global Cybersecurity Outlook 2026, from the World Economic Forum, reports that 94% of leaders expect AI to be the most significant force in cybersecurity in 2026, and 64% of organizations already consider geopolitically motivated attacks in their risk strategies.
Mistakes that stall the plan
The most common mistakes are a plan without a budget, every initiative scheduled for the first wave, initiatives without an owner outside security, and no regular follow-up after approval. A self-reported assessment completes the list because its bias is optimistic, and the plan inherits that bias.
For organizations with a plan already in place, the article 3 questions for a budget-efficient Information Security Master Plan review addresses the review cycle.
A master plan grounded in testing
Vultus builds the master plan from a Red Team Assessment and turns the findings into a roadmap with a budget, goals, and governance. Explore Vultus Information Security Master Plan and see how the maturity assessment works.
