Mitigating the risks posed by malicious code requires the proactive implementation of industry best practices. In today's world, combatting malicious software begins at the CxO level with the recognition that there is a critical business need for an information security program and the appropriate high-level staffing for that program [1]. The components of the information security program will vary according to business needs. In this two-part Bulletin, I will examine those components that must be considered.