Presents a definition of information security strategy, an explanation of the various generic information security strategies available to organisations to choose from, and a process for how to select an information security strategy.