Learn about Halfaker's (midsize business supporting Federal Government with software engineering solutions) approach to, and lessons learned from, designing, building, and refining our enterprise information security program to comply with multiple compliance frameworks. Learn about key decision point related to (1) tools, talent, and processes to invest in early, (2) how to decide when to outsource, (3) recommendations on communicating security risk to non-technical leaders, and (4) high-ROI technology investments, such as Cloud Security Posture Management (CSPM).