A security manager has an approved strategy but no delivery plan. What should be developed next?

1. A new policy title only
2. A guarantee of zero incidents
3. An unrelated technology shopping list
4. A prioritized program roadmap with resources, owners, dependencies, and measures