Developing an information security program that adheres to the basic principles outlined in this guide is the first and most basic step that an agency can take to build an effective security program .
The rules in this guide do not apply to security programs .