This guide is intended to help companies prepare recommendations for the structure of an information systems security organization, including functional requirements and responsibilities, and staffing options to fulfill those responsibilities. The guide includes an outline of functional responsibilities, staffing options, and comments on the impact of training and other costs.