Defining the security program