The Enterprise Strategy Group has been actively following the information security market since 2003. During this timeframe, ESG has undertaken numerous surveys involving thousands of enterprise security professionals and conducted hundreds of interviews with CISOs and other senior security executives. Over the past few years, ESG has noticed change in the information security air. Since enterprises face a much more dangerous threat landscape, they are actively evolving historical tactical security defenses into a more formal information security management framework. Based upon this evolutionary trend, ESG developed a 4-phased security management maturity model. The model is described in this white paper.