The following paper describes the design of an information security program for a midsized organization of roughly 1000 local and remote employees. There are several essential components to creating a security program that include creating a policy, managing risk, life-cycle planning, contingency and disaster planning, awareness training and auditing. A solid security program is vital to protecting the proprietary data of an organization from both internal and external attacks in addition to having an organized plan to maintain productivity and recover in the event of an unforeseen disaster. The combination of knowledge, technology, awareness and accountability help to ensure a successful program.