Why Information Security Plans Fail (and How to Build One That Doesn't)

Most breaches don't happen because attackers are geniuses. They happen because of a missing patch, a password without a second factor, or a vendor nobody thought to check. A written security plan matters, but only if it addresses the gaps that real attackers exploit.

1. What Actually Goes Wrong

Information security means protecting data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction. For a business, that covers customer data, financial records, intellectual property, and the operational details that keep things running.

The risks are concrete: financial loss from fraud, theft, or ransomware; legal penalties under regulations like GDPR, HIPAA, or PCI DSS; lost customer trust; and operational downtime.

Some of the best-known incidents show how these risks play out.

• Target (2013): the vendor problem. Attackers got into Target's network using credentials stolen from an HVAC contractor. From there they reached the point-of-sale systems and took data on roughly 40 million payment cards. The lesson is that your security is only as strong as your least-protected supplier.

• Equifax (2017): the patching problem. A known vulnerability in Apache Struts went unpatched on an internet-facing system. The result was the exposure of personal data belonging to about 147 million people and a settlement of around $700 million. The fix had been available for months.

• Colonial Pipeline (2021): the basic-controls problem. Attackers got in through a single compromised VPN password on an account without multi-factor authentication. The company shut down the pipeline that supplies much of the US East Coast's fuel, and it paid a ransom of about $4.4 million. One missing control caused a national disruption.

• Change Healthcare (2024): the same lesson, again. A ransomware attack on a major US healthcare payments processor began with a remote-access portal that lacked MFA. It disrupted pharmacies and providers for weeks and affected roughly 190 million people, one of the largest healthcare data breaches on record.

Not every major incident is an attack. In July 2024, a faulty CrowdStrike software update crashed millions of Windows machines, grounding flights and knocking hospitals offline. Availability is part of security too, and change management and testing belong in your plan.

Notice that none of these stories involves exotic hacking. The causes were unpatched software, missing MFA, weak vendor oversight, and untested backups.

2. Key Components of an Effective Information Security Plan

A good plan spans people, processes, and technology. Here's what each component should do in practice, with the incidents above as a guide.

1. Risk assessment

Identify the threats specific to your business. A company holding customer payment data should focus on databases and access controls, and every company should list its vendors and what access each one has. Target is the reminder.

2. Policies and procedures

Write clear rules for acceptable use, data handling, password management, and incident response. Keep them short enough that people read them, and train employees regularly.

3. Access control 

Give people only the access their role requires. Require multi-factor authentication on everything remote-facing, including VPNs, admin portals, and email. Colonial Pipeline and Change Healthcare both trace back to this gap.

4. Data protection 

Encrypt sensitive data at rest and in transit. Keep backups that are offline or immutable, and test restoring from them. A backup you've never restored is a hope, not a plan.

5. Patch and vulnerability management

Track what software you run and patch exposed systems quickly. Equifax is the cautionary tale, and the Log4Shell flaw in late 2021 showed how fast a single library vulnerability can become everyone's emergency.

6. Monitoring and incident response. 

Watch for suspicious activity, and write down who does what when something goes wrong, including who calls legal, who talks to customers, and who decides whether to shut systems down. Rehearse it. Uber's 2016 breach became a scandal partly because the company concealed it, and its former security chief was later convicted for that cover-up.

7. Audits and updates 

Review controls periodically and after any major change to your business, tooling, or vendors.

3. What is ISO 27001 and ISMS?

ISO 27001 is the international standard for an Information Security Management System (ISMS), a structured way to manage information security through risk assessment, defined controls, and continual improvement. It covers people, processes, and IT systems together.

The standard was updated in 2022, and its Annex A controls were reorganized into 93 controls in four themes. Organizations certified to the older version had a transition period to move over, so if you're starting now, work from the current version.

The benefits:

• A repeatable, documented way to find and manage risk

• Easier compliance with legal and regulatory requirements

• Customer and partner confidence backed by an independent audit

• Security that gets reviewed and improved over time instead of set once and forgotten

Certification isn't the only goal. Even without pursuing it, the framework is a solid checklist for building a plan that doesn't have blind spots.

4. Practical Steps to Develop Your Information Security Plan

1. Define scope and objectives. Decide which assets, systems, and data you're protecting.

2. Run a risk assessment. List threats and vulnerabilities, and rank them by likelihood and impact.

3. Write policies and procedures. Cover data handling, access, and incident management.

4. Implement controls. Start with the high-impact basics: MFA, patching, encryption, tested backups, and endpoint protection.

5. Train your people. Phishing and stolen credentials sit behind a large share of breaches, so staff are part of your defense.

6. Monitor and review. Log, alert, and revisit policies on a schedule.

7. Prepare for incidents. Name an incident response team, write the playbook, and run a tabletop exercise.

5. The Long-Term Value of Investing in Information Security

Competitive advantage: Customers and partners increasingly ask about security before signing.

• Operational resilience: Well-defined processes reduce downtime, and recovery is faster when you've practiced it.

• Cost savings: Breach costs pile up through remediation, legal fees, notification, and lost business, and prevention is almost always cheaper.

• Business continuity: Maersk rebuilt in days because someone had a surviving copy, and you should have a better plan than luck.

  
  

Threats keep evolving, but the basics have stayed remarkably consistent: know your assets, control access, patch fast, back up properly, and practice your response. Start there, and build the rest around it.

By prioritizing information security, businesses can protect their most valuable assets and thrive in a digital world. Start building your security plan today to stay ahead of threats and secure your success.

At Gorisco, we help organizations strengthen resilience by aligning people, processes, and technology. From governance frameworks to remote-work policies, our focus is on building secure, transparent, and continuity-ready operations in today’s connected world. 

To read our other blogs, click here. We would love to hear your thoughts, so please share your comments!