This document discusses information security planning and contingency planning. It covers developing information security policies, standards, and practices as the foundation for an information security program. It also discusses creating an information security blueprint, implementing security education and training programs, and developing incident response, disaster recovery, and business continuity plans. The goal is to plan strategically for security and have contingencies in place to prepare for potential business disruptions.