CISSP-ISSEP: Information Systems Security Engineering Professional

Security education, information classification, and a defined security organization are substantive security-program objectives. A security plan is instead a formal planning document that describes security requirements and the controls used to meet them, rather than an objective itself.