IT security plan: contents, steps and tools

An IT security plan says who does what, and by when. What it typically contains, how it differs from a security policy, seven steps to build it and the tools to track it.

15 October 2026 · 11 min read

Illustration: a grid of ticked glass boxes, one in orange

An IT security plan is the list of measures an organisation commits to implementing to reduce its cyber risk, each with an owner, a deadline, a budget and a status. It is often confused with the security policy, which sets the rules. The plan says how those rules are applied and how gaps are closed, quarter after quarter. Here is what it typically contains, how to build it, an example and the tools to track it.

IT security plan: definition

The IT security plan (also called a security action plan or remediation plan) turns the conclusions of three processes into concrete actions: the risk analysis, cybersecurity audits and the obligations that apply to the organisation. It usually covers one to three years, split into quarters.

Frameworks require it under other names. ISO 27001 requires a risk treatment plan (clause 6.1.3) and, for each security objective, a statement of what will be done, with which resources, by whom, by when and how results will be evaluated (clause 6.2). The French EBIOS Risk Manager method ends its fifth workshop with a continuous security improvement plan. NIS 2 expects risk management measures and an assessment of their effectiveness (Article 21).

Security plan, policy, AUP, BCP: who does what

Document	Question it answers	Horizon	Audience
Security policy	Which security rules apply, and who is accountable?	Lasting, reviewed yearly	Management, IT, business teams
IT security plan	Which actions, by whom and when, to reduce risk?	One to three years, tracked quarterly	CISO, CIO, action owners, management
Cybersecurity roadmap	Where do we want to be in three years, and through which major steps?	Three years	Management, risk committee
Acceptable use policy	What should each user do, and not do?	Lasting	All staff
BCP and DRP	How do we keep going and restart after a disaster?	Lasting, tested yearly	Management, business, IT

The roadmap sets the course; the security plan is its operational detail, often for the current year. The policy says “all remote access uses multi-factor authentication”; the plan says “multi-factor authentication on the VPN for all contractors, owner IT, end of Q1”.

What an IT security plan contains

Scope and objectives: entities, sites and systems covered; measurable objectives where possible.
Current state: audit results, gaps against the chosen reference, recent incidents.
Priority risks: scenarios selected by the risk analysis, with current and target levels (see inherent and residual risk).
Action list: for each, a description, the risk or requirement covered, an owner, a deadline, a budget or effort, a priority and a status.
Exceptions: knowingly accepted gaps, with justification, compensating measures and an end date.
Indicators: progress, overdue actions, risk trends, fed into the security dashboard.
Governance: who approves the plan, how often it is reviewed, how it is reported to management.

Building an IT security plan in 7 steps

Set the scope and mandate. Management appoints a lead, often the CISO, and approves the plan's horizon.
Pick a reference framework. A national hygiene guide such as ANSSI's for a first effort; your national NIS 2 framework if you are in scope (in France, ANSSI's ReCyF, version 2.5 published in March 2026); ISO 27001 Annex A or NIST CSF for a broader approach.
Assess the current state through interviews and evidence: what is in place, partly in place, missing.
Link gaps to risks. A gap that matches no significant risk can wait; a gap on a severe scenario goes to the top.
Prioritise. Weigh risk reduction against effort: strong, cheap measures first, large projects broken into stages.
Plan and cost: a named owner (not a department), a realistic deadline, a budget and effort estimate.
Get approval and track. Management sign-off, monthly progress review, quarterly report, updates after every incident or audit.

Animated diagram: on the left, three sources (risk analysis, audits and gaps, requirements such as NIS 2 and the GDPR) feed an action table; below, a dashed frame recalls that the security policy holds the rules, stable and reviewed every year. The table lists five actions with owner and deadline: multi-factor authentication on remote access (IT, quarter 1), offline backups (operations, quarter 2), privileged accounts reviewed (CISO, quarter 2), supplier security clauses (procurement, quarter 3), crisis exercise (management, quarter 4). Quarter by quarter, statuses move from “to do” to “in progress” then “done” and the progress bar fills up. Message: the policy sets the rules, the plan says who does what and by when. — The security plan turns the results of risk analyses, audits and requirements into dated, tracked actions. The security policy sets the rules. Video labels in French (PSSI is the French acronym for the security policy).

Priority measures for a first plan

For organisations just starting out in France, ANSSI's MonAideCyber service offers a free diagnostic with a volunteer adviser, ending with six priority measures to implement within six months. Hygiene guides and NIS 2 frameworks take it further. The same domains come up in all of them:

Domain	Example measures	Why it comes first
Accounts and access	Multi-factor authentication on remote access and email, separate admin accounts, access reviews	Stolen credentials are the main way in
Patching	Patches applied within a set time, internet-facing systems first	Known flaws are exploited within days
Backups	Offline or isolated copy, tested restore	It is what lets you restart after ransomware
Internet exposure	Inventory of exposed services, close what is not needed	You cannot protect what you do not know
Endpoints and network	Standard user rights, anti-malware, segmentation of sensitive zones	Limit how far an attack spreads
Logging and detection	Centralised, retained logs; alerts on privileged accounts	Detect early, and be able to investigate
People	Awareness for exposed roles, simple reporting (see the human firewall)	Phishing remains the top vector
Third parties	List of critical providers, security clauses, assessment (see third-party risk management)	A growing share of attacks comes through a supplier
Incidents and crisis	Response procedure, emergency contacts, yearly exercise	Save hours on the day an incident hits

An example IT security plan

Fictional example: a 150-employee manufacturer with two sites, one IT person and a managed service provider. After a diagnostic against a national hygiene guide and a simplified risk analysis, it adopts the following plan for the year:

Action	Risk covered	Owner	Due	Effort
Multi-factor authentication on email and VPN	Credential theft	IT	Q1	Low
Offline backup and restore test	Ransomware, data loss	Provider	Q1	Medium
Inventory of exposed systems, close unneeded access	Exploited flaws	Provider	Q2	Low
Separate admin accounts, access review	Privilege escalation	IT	Q2	Medium
Bank detail change verification procedure	Payment fraud	Finance	Q2	Low
Segment the production network	Production shutdown	Provider	Q3	High
Security clauses in the five critical providers' contracts	Supplier-borne attack	Procurement	Q3	Medium
Incident response procedure and exercise	Poorly handled crisis	Executive management	Q4	Medium

Segmentation, too heavy for one quarter, is split: study in Q3, delivery the following year as part of the three-year roadmap. Meanwhile, a documented exception accepts the gap with a compensating measure (closer monitoring of access to the production network).

Tools to track an IT security plan

Spreadsheets. Enough for twenty or so actions and a single lead. Limits show quickly: multiple versions, no reminders, lost history, manual consolidation of actions from different processes.
Project management tools. Useful for technical projects, but they do not link an action to the risk or requirement it covers.
GRC platforms. They link each action to its source (risk, requirement, audit, supplier), chase owners, track exceptions and update the risk level as the action progresses. Our overview of GRC tools helps you choose.

In an ISMS, the plan feeds the management review. Phinasoft brings together the actions arising from risk analyses, audits, campaigns and supplier assessments, with deadlines, reminders, exceptions and management reports.

Summary

Actions, not rules

An IT security plan lists dated measures with an owner, a budget and a status. The security policy sets lasting rules; the plan says how you get closer to them.

Start from risk

Build it from your risk analysis, audits and obligations, comparing the current state to a reference (such as ANSSI's hygiene guide or your NIS 2 framework), then prioritise.

Track and report

A plan is only worth something if it moves: monthly review, simple indicators, documented exceptions and a report to management.

Frequently asked questions

What is an IT security plan?

It is the operational document listing the security measures to implement over a given period, usually one to three years, each with an owner, a deadline, a budget and a status. It derives from the risk analysis, audits and regulatory obligations.

What is the difference between a security plan and a security policy?

The information security policy sets lasting rules and principles: who can access what, how data is protected, who is accountable. The security plan says which actions to carry out, by whom and when, to apply those rules and reduce risk. The policy changes little; the plan moves every quarter.

What does an IT security plan contain?

Scope and objectives, current state, priority risks, the list of actions (description, risk or requirement covered, owner, deadline, budget, priority, status), accepted exceptions, tracking indicators, and the approval and review process.

Is an IT security plan mandatory?

No law uses that exact name, but several require it in substance: ISO 27001 requires a risk treatment plan and plans to achieve security objectives; NIS 2 requires risk management measures and assessment of their effectiveness; the GDPR requires security measures appropriate to the risk. A dated, tracked plan is the simplest way to demonstrate it.

Which measures should come first?

Those that cut the most risk for moderate effort: multi-factor authentication on remote access and privileged accounts, patching, tested offline backups, an inventory of internet-facing systems, awareness for exposed roles and an incident response procedure. Hygiene guides from national agencies help choose them.

Which tool should I use to track a security plan?

A spreadsheet is enough for twenty or so actions and a single owner. Beyond that, or when actions come from several processes (risk analyses, audits, supplier assessments), action plan tracking software or a GRC platform avoids duplicates, chases owners and produces management reports.

Sources (8)

A platform and service that adapt to you

Our platform is designed for fine-tuned configuration and broad adaptability to your needs.

Request a demo